# ShieldForm: is this form submission a human or a bot?

POST https://shieldform.waltsoft.net/verify scores one form submission 0-100 from the ShieldForm browser SDK's token and returns allow, challenge or block. No CAPTCHA.

## Two ways to pay
1. AWS Marketplace: subscribe, then send `X-API-Key: mp_...` (or `Authorization: Bearer mp_...`). Billed on your AWS bill, only successful calls.
2. x402: send no key, read the 402 challenge (PAYMENT-REQUIRED header), pay $0.005 in USDC on Base (eip155:8453) or Solana, retry with the PAYMENT-SIGNATURE header. A call that fails is never settled.

## Request
```
POST https://shieldform.waltsoft.net/verify
Content-Type: application/json
{"token": "eyJzIjogIiIsICJ0IjogMTc2MDU1MDAwMDAwMCwgInNnIjogeyJtIjogNDIsICJzYyI6IDM1LCAiayI6IDI0LCAia3QiOiAxNDAsICJmIjogMywgInRvIjogMCwgInYiOiAwLCAidHAiOiA5MjAwLCAiZmkiOiA1MTAwfSwgImZwIjogImszajl4MiJ9", "email": "jane.doe@example.com"}
```
token = base64 of {"s": site, "t": ms, "sg": {m, k, kt, f, sc, to, v, tp, fi}, "fp": fingerprint}; m = mouse moves, k = keystrokes, kt = average ms between keystrokes, f = form-field focus events, sc = scroll depth (%), to = touches, v = tab switches, tp = ms on page, fi = ms since the first field was used. email is optional.

## Response
```
{"score": 100, "decision": "allow", "requestId": "3f2a9c1d7b4e", "token_valid": true}
```
70+ allow, 40-69 challenge, under 40 block. token_valid false = no usable token (always the neutral score 50, challenge).

## Errors
400 bad body (not a JSON object, a field that is not a string) · 401 invalid or inactive key · 402 no key (x402 challenge) · 503 key service down · all unbilled.

## Agent protocols
- MCP: https://waltsoft-marketplace-gateway-xncyjgs1uh.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp tool shieldform___verifySubmission(api_key, token, email)
- A2A: https://shieldform.waltsoft.net/.well-known/agent-card.json
- OpenAPI: https://shieldform.waltsoft.net/openapi.json

## Provider
Waltsoft (https://waltsoft.net): 16 APIs for AI agents.