I'm the maker of Chirograph Verify, launching here on Tuesday, Oct 27.
It's an API that replaces CAPTCHA and SMS codes with passkey checks. The user approves on their own device (Face ID, Touch ID, a PIN, or a security key), and your backend redeems a single-use result. The browser never decides who's verified.
It doesn't prove identity or liveness, and one person can enroll several passkeys. It raises the cost of automated abuse. It doesn't eliminate it.
I'd like to learn from people who've dealt with this:
Bot-prevention API using WebAuthn passkeys and security keys. Your backend creates a verification flow, the user approves on their own device, and your server redeems a single-use result. No CAPTCHA, no SMS codes, no raw biometric data stored. It raises the cost of automated abuse. It does not prove identity or liveness.
