> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agg.market/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Turnstile token

> Verifies a Cloudflare Turnstile token against the app's linked widget. Intended to be called from **your backend**, not the browser — API keys are secrets and must never ship to the client. Both `x-app-id` and `x-app-api-key` are required; the server rejects the request with `401` if `x-app-id` does not match the app embedded in the API key. Create a key via `POST /apps/:appId/api-keys` (admin JWT required). Returns `{ success: true }` on a valid token or `403` if verification fails. Tokens are single-use (replay-protected).



## OpenAPI

````yaml /openapi/openapi.json post /bot-protection/verify
openapi: 3.0.2
info:
  title: AGG API
  version: 1.0.0
  description: >-
    Prediction market aggregator REST API — authentication, users, venue events,
    venue markets, orderbooks, charts, and execution workflows.
servers:
  - url: https://api.agg.market
    description: Production
  - url: https://api.staging.agg.market
    description: Staging
security: []
paths:
  /bot-protection/verify:
    post:
      tags:
        - Bot Protection
      summary: Verify Turnstile token
      description: >-
        Verifies a Cloudflare Turnstile token against the app's linked widget.
        Intended to be called from **your backend**, not the browser — API keys
        are secrets and must never ship to the client. Both `x-app-id` and
        `x-app-api-key` are required; the server rejects the request with `401`
        if `x-app-id` does not match the app embedded in the API key. Create a
        key via `POST /apps/:appId/api-keys` (admin JWT required). Returns `{
        success: true }` on a valid token or `403` if verification fails. Tokens
        are single-use (replay-protected).
      operationId: botProtectionVerify
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - turnstileToken
              properties:
                turnstileToken:
                  minLength: 1
                  maxLength: 2048
                  type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                properties:
                  success:
                    type: boolean
        '400':
          description: '400'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '401':
          description: '401'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '403':
          description: '403'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
        '429':
          description: '429'
          content:
            application/json:
              schema:
                type: object
                required:
                  - message
                properties:
                  message:
                    type: string
      security:
        - appApiKey: []
components:
  securitySchemes:
    appApiKey:
      type: apiKey
      in: header
      name: x-app-api-key
      description: App-scoped API key for programmatic app management.

````