Nownce by Xenqube Request a sandbox key

Nownce · Human presence, not identity

Proof that a human is here.

A sub-3-second presence check that issues a short-lived Human Badge. No puzzles for people to fail, no ID documents to store, and nothing a bot farm can screenshot and replay.

Try a pulse See the API
  • <3 sTypical check, cue to badge
  • H1 · H2 · H3Badge levels by action risk
  • 0Identity documents or biometrics stored
nownce.xenqube.com/verify
Human Badge issued · H2 · expires in 10:00

Why now

Puzzles are solved by machines. ID checks are too heavy for a comment box.

Signup farms burn free-tier credits, scalper scripts empty limited drops in seconds, and comment spam is now written by models. Apps need proof that a person is acting right now, at the level of friction the action deserves.

CAPTCHAs

Vision models and solving farms pass image puzzles for fractions of a cent. Humans fail them more often than bots do.

Verdict: friction without protection

Identity verification

Document and face checks are the right tool for regulated onboarding. For a comment, a vote, or a free trial they are a liability you now have to store.

Verdict: right tool, wrong moment

Nownce

A one-time cue, a timed human response, and a signed badge that expires. Nothing about who the person is; only that one is present.

Verdict: presence, scoped to the action

How it works

A cue, a response, a badge that expires.

When your app asks "is a human here?", Nownce plays a one-time cue in the browser or app. The person responds with a natural gesture. Your server verifies the signed badge with one call.

  1. 01 · Cue

    A one-time sequence

    Generated server-side per session. There is no static puzzle to screenshot, cache, or farm out.

  2. 02 · Response

    Timed human input

    Tap, tilt, swipe, or speak in time with the cue. Scoring looks at rhythm and variance, the way a body in the room behaves and a script does not.

  3. 03 · Badge

    A signed, expiring pass

    Your client receives a badge token with a level (H1 to H3) and an expiry of minutes. Your server verifies it once; the nonce prevents replay.

Try it

Watch the pulse. Tap with it.

A browser-only taste of the presence check. Six beats, about four seconds. Nothing is sent anywhere.

  • A new cue each round
  • Scored on timing, not on knowing an answer
  • No camera, no microphone, no account
Local demo · nothing transmitted

Watch the pulse, then tap with it.

Human Badge

Three levels. Match the check to the risk.

Every badge carries a level, an expiry, and a nonce. Your server decides which level each action needs.

H1

Light gate for comments, votes, and low-risk actions.

Cue
1 to 2 seconds
Expiry
30 minutes
Use
Comments, votes, referral claims

H2

Standard check for signups, free-tier claims, and limited drops.

Cue
2 to 3 seconds
Expiry
10 minutes
Use
Signups, trials, checkout on drops

H3

Step-up presence for payouts, key issuance, and abuse-heavy moments.

Cue
Two-stage, 4 to 6 seconds
Expiry
2 minutes, single use
Use
Withdrawals, API keys, bulk actions

See where each level fits

Where to use it

Six moments where bots do the most damage.

Put the check exactly where the abuse happens. Light levels for everyday actions, H3 when money leaves.

H2 badge

Sign-ups and free trials

Stop one script from creating hundreds of accounts to farm credits or trial access.

Where: the "Create account" or "Start free trial" submit.

H1 badge

Comments and posts

Cut model-written spam floods without asking commenters to prove who they are.

Where: right before a comment, review, or post is published.

H2 badge

Checkout and limited drops

Raise the cost of scalper bots and inventory-sniping scripts during high-demand releases.

Where: before checkout on limited or high-demand items.

H1 badge

Votes, referrals, and rewards

One genuine action per person: no ballot stuffing, no referral farming, no identity collected.

Where: before a vote is cast or a referral reward is claimed.

H3 badge

Payouts and withdrawals

A two-stage, single-use presence check for the highest-risk financial actions.

Where: right before money leaves an account.

H2 badge

APIs and agent-heavy surfaces

Confirm a human is behind a request before it reaches keys, quotas, or bulk endpoints.

Where: before an API key is issued or a bulk action runs.

Integration

One script tag. One server call.

Nownce ships as a small client script and a verify endpoint. Your backend never trusts the browser: it verifies the badge token and receives the level, expiry, and a single-use nonce.

  1. Mount the checkAdd the script and call nownce.check({ level: "H2" }) where the action happens. It resolves with a signed badge token.
  2. Verify server-sidePOST the token to /v1/verify with your secret key. Reject anything below the level your action needs.
  3. Consume the nonceStore the nonce for the badge's lifetime. A second verify with the same nonce returns replayed: true.
server.tsclient.jscurl
POST /v1/verify
// After nownce.check() resolves in the browser and the token
// reaches your backend with the form submission:
const res = await fetch("https://api.nownce.xenqube.com/v1/verify", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.NOWNCE_SECRET}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ token, minLevel: "H2", action: "signup" }),
});

const badge = await res.json();
// {
//   valid: true,
//   level: "H2",
//   issuedAt: "2026-09-19T18:12:04Z",
//   expiresAt: "2026-09-19T18:22:04Z",
//   nonce: "b7e1…9c",        // store; reject if seen again
//   replayed: false
// }

if (!badge.valid || badge.replayed) return deny(403);

Client SDK for web today; iOS and Android in pilot. Endpoint shapes shown are the pilot API and may change before general availability.

Data handling

Presence, not identity. Here is exactly what that means.

The list below is the whole story. There is no identity vault because there is nothing to put in one.

Never collected

  • Names, emails, or account identifiers from your users
  • Government documents or selfies
  • Face, voice, or fingerprint templates
  • Raw gesture or timing traces after scoring
  • Cross-app identifiers that link one person's badges

Kept for the badge lifetime

  • Badge id, level, issued and expiry timestamps
  • Pass or fail score for the cue
  • The single-use nonce, until it expires
  • Your app id and the action label you passed
  • Aggregate pass rates for your dashboard, no per-user rows

Why Nownce

What changes when presence is proven.

Fewer fake accounts, less wasted spend, and trust that does not demand a dossier from every visitor.

  • Stop the farm, not the person

    Raise the cost of automated abuse without turning every session into an interrogation.

  • Nothing to breach

    No identity data means no identity data to leak, subpoena, or explain to a regulator.

  • Match the level to the moment

    H1 for chatter, H2 for signups and drops, H3 when money or keys move.

  • Built for an agent-heavy internet

    Start with a presence gate. Grow toward private, portable proof across apps when you need it.

Roadmap

From "here now" to proof that travels.

Today the goal is proving a human is present. Next, that proof should move with the person without revealing more than the claim itself.

  1. Now · Pilot

    Presence gate

    Live cues, timed responses, signed badges at three levels, web SDK and verify API.

  2. Next

    Adaptive difficulty

    Cue length and modality adjust to observed farm pressure per app, without changing your integration.

  3. Later

    Private credentials

    Prove "I hold a fresh, valid badge" to a third party without revealing where or how it was earned.

  4. Beyond

    Agent-era trust

    A clear human-presence signal for the moments where software agents should not act alone.

Prove the claim. Reveal nothing else.

The design target for the credential phase: someone can show "a human passed an H2 check in the last ten minutes" without handing over timing traces, biometrics, or a trail that links every app they use.

Who pays for it

Teams paying for bot volume today.

Companies buy the checks; their users complete a short presence moment and nothing else.

AI products with free tiers

Stop inference credits leaking to signup farms.

Communities and forums

Cut model-written spam and fake accounts.

Marketplaces and drops

Raise the cost of scalper scripts.

Fintech and payouts

Confirm a human before money or keys move.

FAQ

Questions security and product teams ask first.

  • Is Nownce a CAPTCHA?

    No. A CAPTCHA asks a person to solve a static puzzle that farms and vision models now solve cheaply. Nownce plays a one-time cue and scores the timing of a live response, then issues a badge that expires in minutes.

  • Does Nownce verify identity?

    No. Nownce proves presence, not identity. It does not collect names, documents, faces, or fingerprints. If you need KYC, keep your KYC vendor and place Nownce in front of it to stop automated volume before it reaches the expensive step.

  • What is stored after a check?

    A badge id, level, issue and expiry time, and a pass or fail score. Raw timing traces are discarded after scoring. Nothing links badges across different apps.

  • How is a badge verified on my server?

    Your client receives a signed badge token. Your server posts it to the verify endpoint with your secret key and receives level, expiry, and a one-time nonce so the same badge cannot be replayed.

  • What about accessibility?

    Cues are offered in more than one modality (visual, haptic, audio) and the response can be a tap, a tilt, or a spoken beat. A person who cannot complete one modality is offered another, not failed.

  • What does it cost?

    Nownce is in pilot. Pricing is per verified check with a monthly minimum, set per pilot. Contact Xenqube for a quote and a sandbox key.

Get started

Ship a human gate without the ordeal.

Tell us where bots cost you today. You get a sandbox key, the badge level per action, and an integration plan for your stack within a week.

Built and operated by Xenqube, the enterprise AI studio behind the Xenith product line.

Request a sandbox key Nownce on xenqube.com