1. Private Access Token (Safari on iPhone, iPad or Mac)
On /v1/challenge, Safari is first answered with 401 WWW-Authenticate: PrivateToken.
The device asks Apple to attest it, obtains a blind-signed token from the issuer and presents it; the API
verifies it locally (issuer public key, no call to Apple or Cloudflare). Other browsers silently fall back to
the normal flow.
iPhone prerequisites
- iOS 16 or later, Safari;
- signed in to iCloud;
- Settings → [your name] → Sign-In & Security → Automatic Verification enabled;
- this page opened over HTTPS on a real domain (the tunnel), not
localhost.
Open this page on the iPhone
2. Native apps: App Attest and Play Integrity (recorded fixtures)
These APIs only exist inside native iOS / Android apps. HexaCaptcha ships the server-side verification SDK; this page replays recorded fixtures — signed by HexaCaptcha test keys, not by Apple or Google — through that SDK and shows every check.