python-flask.py

# APTOGON gesture-CAPTCHA — Python / Flask server-side validation.
#
#   pip install flask requests
#   APTOGON_SECRET_KEY=sk_live_... python examples/python-flask.py
#
# The secret key comes from the environment — never hard-code it, never send it to
# the browser. Only pk_live_ belongs in your HTML.

import os
import requests
from flask import Flask, request, abort

APTOGON_SECRET = os.environ["APTOGON_SECRET_KEY"]  # sk_live_...
app = Flask(__name__)


def verify_captcha(token: str) -> bool:
    """Confirm a captcha token with APTOGON. True only for a real human."""
    if not token:
        return False
    try:
        r = requests.post(
            "https://homosapience.org/api/captcha/siteverify",
            headers={"Authorization": f"Bearer {APTOGON_SECRET}"},
            json={"token": token},
            timeout=5,
        )
    except requests.RequestException:
        return False  # network error — fail closed
    if r.status_code != 200:
        return False  # 401 bad key · 409 replay · 400 expired/invalid
    data = r.json()
    return data.get("success") is True and data.get("human") is True


@app.post("/signup")
def signup():
    # The widget added this hidden field to the form on success.
    if not verify_captcha(request.form.get("aptogon-response", "")):
        abort(400, "Please complete the human check.")

    # ...captcha passed — continue your normal signup here.
    return "Welcome, human!"


if __name__ == "__main__":
    app.run(port=3000)