Verify Endpoint
Trade a Turnstile token for a scan pass. Proving browser-ness is now its own step, not a passenger on the first scan.
It used to only happen INSIDE /api/scan, which forced the client to hold the scan until a token existed — www waits up to 2.8s for the widget and then scans without one anyway, so a slow link silently bought the weak engine. Verification can now finish while the user is still typing, and the pass applies from the first scan onward.
Returns the pass in the BODY as well as a cookie: the cookie is third-party for every one of our clients (page scanforai.com, API api.scanforai.com), so it is the copy most likely to be discarded. Clients keep the string and send it back as X-Scan-Pass.
Never an error path for the caller: a bad token answers 200 with ok=false, and the scan endpoint still degrades rather than rejecting, so a client that cannot verify at all keeps working on the unverified quota.
Request
- Base URL: https://api.scanforai.com (the document declares no server; this is the origin it was published from)
- URL: https://api.scanforai.com/api/verify
- Auth: none declared
Query parameters
The same as the X-UI-Lang header, for requests a browser makes without custom headers. If both are sent, lang wins.
Headers
Language of the answer's message fields (a language code such as en or es; only the part before any - is used). Without it, the answer is English as always and error bodies carry no message.
Request body
Response
Successful Response
Changes
No recorded changes to this operation across all 1 revision of this API.