Stop the bots without punishing the people.
AuthCaptcha is Authpermit's application-security product: invisible risk assessment first, a small proof of work that costs a person nothing and a credential-stuffing run a lot, and a challenge only when the risk engine asks for one. Every answer comes with a decision, a score and the reasons behind it.
Invisible by default
Most visitors never see a puzzle. The widget solves a proof of work in the background while the page is read, and the box ticks itself.
Explainable decisions
allow, allow_with_monitoring, challenge, step_up_authentication, throttle or deny, with the reason codes that produced it. No model whose answer cannot be explained.
Accessible
No images to identify, no distorted text to type. Nothing here fails a screen-reader user.
Private
Addresses are counted under a key that changes every day and are never stored. Signals are counts, never keystrokes or content.
Single-use tokens
Your server redeems each token once with its secret and gets the whole verdict. A replayed token is refused.
Hands off to Authorizer
When the answer is step_up_authentication, Authpermit sends the person to Authorizer to prove it's them, so a suspicious sign-up does not have to be a lost one.