Bot Protection Frame

GET

api

forms

bot-check

curl --request GET \
  --url https://api.sequenzy.com/api/v1/forms/bot-check \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.sequenzy.com/api/v1/forms/bot-check', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/bot-check",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/bot-check"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/bot-check")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

<!doctype html>
<html lang="en">
  <!-- Renders the Turnstile widget and posts its token to the embedding page. -->
</html>

Serves the Cloudflare Turnstile check for saved forms and popups with bot protection turned on. No API key is required, and you do not need to call it yourself: the saved form embed script and popups load it in a small iframe and send its token with the submission as sequenzyBotCheckToken. The check runs on Sequenzy’s own domain, so it works on any site you embed a form or popup on. Most visitors never see it. When Cloudflare needs a visitor to confirm they are human, the iframe expands at the end of the form.

Check result	Outcome
Passed	Subscribed as usual
Failed, or no token (for example the plain HTML form snippet, which cannot run the check)	Must confirm by email before they are subscribed
Failed, after the workspace’s confirmation email or sender was removed	`400` asking the visitor to try again
Cloudflare unreachable	Subscribed as usual, so an outage never blocks signups

Turning bot protection on requires a double opt-in confirmation email and a sender profile, because failed signups are sent that email. If your site sets a Content Security Policy, allow frame-src https://api.sequenzy.com. Otherwise the check cannot load, and every signup goes through email confirmation. Turn bot protection on in the form or popup builder, or with botProtection on create saved form, update saved form, create popup and update popup.

Responses

<!doctype html>
<html lang="en">
  <!-- Renders the Turnstile widget and posts its token to the embedding page. -->
</html>

Bot Protection Frame

curl --request GET \
  --url https://api.sequenzy.com/api/v1/forms/bot-check \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.sequenzy.com/api/v1/forms/bot-check', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sequenzy.com/api/v1/forms/bot-check",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sequenzy.com/api/v1/forms/bot-check"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.sequenzy.com/api/v1/forms/bot-check")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

<!doctype html>
<html lang="en">
  <!-- Renders the Turnstile widget and posts its token to the embedding page. -->
</html>

​What happens to each signup

​Responses

What happens to each signup

Responses