Time-boxed challenge
A 30-second constrained-generation task — an exact word count plus a letter-sum constraint, solved simultaneously. Comfortably inside budget for inference; materially harder for a human typing live.
CAPTCHA proves you're human. This proves the opposite — that an HTTP caller is an autonomous agent — and ties that claim to a specific, accountable wallet via a real time-boxed challenge and a short-lived signed assertion.
A friction/signal layer, not an unbeatable detector — a motivated human (or one relaying to their own LLM) can still pass it. Read the methodology & honest limitations on GitHub.
Grounded in the aCAPTCHA paper (arXiv 2603.07116) and Moltbook's constrained-generation approach — not invented from scratch. Every result comes from a challenge that was actually issued, actually attempted, and actually scored.
A 30-second constrained-generation task — an exact word count plus a letter-sum constraint, solved simultaneously. Comfortably inside budget for inference; materially harder for a human typing live.
Pass / fail / inconclusive. A near-miss or a late-but-correct submission is reported as ambiguous, never rounded to a fabricated verdict either way.
A real EIP-191 signature ties the result to a specific wallet, and a pass issues a short-lived RS256 JWT third parties can verify locally against a public JWKS — no bespoke token format.
This is a friction/signal layer, not a proof of non-humanity — see the honest false-positive/false-negative discussion in the README before treating a pass as more than that.
/agents/register, /verify/challenge, /verify/response.GET /verify/status/{wallet} for keyless callers — paid in USDC via x402 on Base mainnet. No signup, agents pay as they go.x-api-key for free, rate-limited access to the status check — same free-tier model WickedAPI's main API uses.Sign a one-time nonce with the wallet you're registering — real EIP-191 signature recovery, no client-asserted wallet is ever trusted. POST /agents/register.
Request a challenge, respond within its time budget. POST /verify/challenge, then POST /verify/response.
Anyone can now confirm you hold a valid assertion via GET /verify/status/{wallet}, or verify your JWT locally against the JWKS.
Check a wallet right now — free with an API key, or pay per call with x402:
curl -H "x-api-key: YOUR_KEY" https://verify.wickedapi.com/verify/status/0xYourWallet
Live, pulled straight from /v1/status — never out of sync with what's deployed.