Prove there is a person, without asking them to prove it.

<script src="https://verify.yunzheng.space/v1.js?v=1.3.0" async defer></script>

<form method="post" action="/login">
  <div class="orbit-verify" data-sitekey="ovk_…" data-action="login"></div>
  <button type="submit">Sign in</button>
</form>

The script renders every .orbit-verify container on the page and injects a hidden field named orbit-verify-response into the surrounding form. Create the site key on the Verify page in the console.

The token in the form field is worth nothing until you confirm it. Confirm it once, server-side, before you act on the submission.

const r = await fetch("https://verify.yunzheng.space/v1/siteverify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    secret: process.env.ORBIT_VERIFY_SECRET,
    response: req.body["orbit-verify-response"],
    remoteip: req.ip,
  }),
});
const v = await r.json();
// { success, challenge_ts, hostname, action, score, "error-codes": [] }
if (!v.success) return res.status(400).send("verification failed");

A token can be confirmed once. A second confirmation of the same token fails, which is what stops a captured submission from being replayed.

• No cookies, no iframe, and nothing loaded from a third party.
• No keystrokes and no pointer coordinates are collected.
• Visitor addresses are never stored in the clear.
• Nothing that would let one site's visitors be recognised on another.