Integrate with intention.

Before implementation

1. Identify consequential actions where a human checkpoint adds measurable value.
2. Define the protected resource and required assurance.
3. Make the human request intelligible and accessible.
4. Choose a short result lifetime and a clear recovery policy.

Server responsibilities

1. Generate a unique challenge for a specific action.
2. Authenticate any verification service request using protected credentials.
3. Validate signature or trusted transport, expiry, context, and one-time use.
4. Enforce the application's authorization rules independently.
5. Log outcome codes and relevant context without unnecessary personal payloads.

Test matrix

At minimum, test verified, rejected, expired, duplicated, substituted, rate-limited, inaccessible, interrupted, and upstream-unavailable cases. Browser demos are never evidence of a secure backend.

Release readiness

A real integration requires a published API, threat-model review, privacy documentation, key rotation, observability, and integration support. None of those should be claimed before they exist.