Drop-in widget

delete the captcha.

Same spot in your form. One tap instead of a puzzle. Your device's passkey proves a live human — and a bot, a solving farm, or an AI agent simply can't tap it.

One tapNo image gridsNo biometric vaultSigned proof token
Before Signup with a captcha
I'm not a robot
…then: pick all the buses, fail, try the blurry one, get an audio challenge. Meanwhile bots solve these with vision models for ~$1/1000.
After Same form, Manav check
Submit unlocks once you've verified.
Integrate The entire change

Replace your captcha markup with one element and one script. Read the signed token on submit and verify it server-side against /.well-known/ — no callback to Manav.

<!-- where your captcha used to be -->
<div class="manav-check" data-endpoint="/labs/captcha/api/index.php"></div>
<script src="/labs/captcha/widget.js"></script>

// on submit, the form carries a hidden "manav-token";
// verify its Ed25519 signature against /.well-known/ on your server.

Honest scope: this proves a live human on a real device. A passkey-less browser falls back to a press-&-hold "limited" check (clearly labelled, meant to be rate-limited), and a rooted/emulated device is the residual gap that device-attestation closes. Easier than a captcha for people; structurally harder for software.