A real person behind every account.
One passkey binds an account to a real person. You get a yes or a no, scoped to you alone — no name, no number, nothing that can be matched to them anywhere else.
The proof is the link, not the moment.
A person proves they are real once. After that the account carries the proof, and every answer you get is about that same proven human, not a fresh guess each time. What you hold is a pairwise opaque ID: an identifier minted for your company alone.
A pairwise opaque ID, never them.
Every company gets its own identifier for the same person: derived for you, stable for the life of the link, useless anywhere else. Two companies cannot put their lists together and find the same human. We never see a name behind it, and neither do you.
Reach, not control.
A link is a line to them, not a hold over them. It cannot message them, act for them, or see their other links.
It counts once per ID.
One proven human, one account on your platform — which is the only version of fair that holds.
It is what a gate counts on.
A gate requires a verified account — the pairwise link is the only thing “once per person on your platform” can be counted against. Place a gate, get verified customers.
The link, as the person sees it — one link for this company alone, and it cannot be matched to any other.
One button, behind your own sign-in.
Your user signs in the way they always do. Then one button — Open BotShield — where they land. It opens their BotShield app to a screen called Verify Account; they confirm with their own passkey, or decline. You get a linked account, keyed by an opaque ID. The person stays theirs.
The console side — where Verify with BotShield is on, one surface and one site key each, and the subscribers it produced.
Lets them through, then stops.
A presale, a drop, a vote, a signup — one turn each, and the person is real. A door with a clock, and then it stops.
BotShield Gates ↗Do the thing.
A cart, a trade, a payout, a watch. No door and no clock — it fires inline on your own page.
BotShield Actions ↗The data is with the party that needs it.
We never hold your list. We confirm the person standing at it — and what we do hold, we name.
A gate confirms the customer for your sale and hands them straight back. Nothing moves onto our rails — because the one thing you cannot afford to rent is the list of who is entitled to what.
Five things, and we name them.
The BotShield ID — the person’s own root. An opaque ID — derived at the boundary, not stored. Gate sign-ups — opaque keys against a deal. A count, never a roster. A verified number, where a gate asked for one. You never hold it. Gate logs — ninety days, then deleted.
Holding a count is not holding the list.
Keep your registry. We confirm the customer for your sale — and a platform that refers a buyer never owns the dispute.
Data goes to the one party they chose to do business with. We never sell it. Ever.
The screens on this page are Couch Tour, built on BotShield — shown to make the concept concrete. couchtour.app ↗
Verified Accounts FAQ
How do you verify an account without collecting identity documents?
What does a platform get back when an account is verified?
Can one person verify two accounts on the same platform?
What happens when a customer unlinks?
Does verifying accounts replace our login?
What do you store about a verified account?
Verify the account once. Charge the tap, not the SMS.
Your store, your checkout, your list, your terms — unchanged.
BotShield runs in your browser.
Sign in with Apple or Google, add a passkey, and approve what your agents ask — the same account the phone app will use.
Open app.botshield.ai →