Example: PHP

Verify a token server-side with plain file_get_contents or cURL.

cURL version

<?php

function verify_token(string $token, string $secret): array
{
    $payload = json_encode([
        'token'  => $token,
        'secret' => $secret,
    ]);

    $ch = curl_init('https://verify.nexlolabs.net/api/challenge/verify');
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => $payload,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'Content-Length: ' . strlen($payload),
        ],
        CURLOPT_TIMEOUT        => 10,
    ]);

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($httpCode !== 200) {
        $err = json_decode($response, true);
        throw new RuntimeException($err['error']['message'] ?? 'Verification failed');
    }

    return json_decode($response, true);
}

// ---- in your form handler ----
$token = $_POST['verificationToken'] ?? '';

if ($token === '') {
    http_response_code(400);
    exit('Missing verification token');
}

try {
    $result = verify_token($token, getenv('NLV_SITE_SECRET'));
} catch (RuntimeException $e) {
    http_response_code(400);
    exit($e->getMessage());
}

// Score 0 = bot, 1 = human
if ($result['success'] !== true || $result['score'] < 0.5) {
    http_response_code(400);
    exit('Human verification failed - please try again');
}

// Safe to process the form…
echo 'OK';

stream wrapper version (no cURL)

<?php

function verify_token(string $token, string $secret): array
{
    $payload = json_encode(['token' => $token, 'secret' => $secret]);

    $context = stream_context_create([
        'http' => [
            'method'  => 'POST',
            'header'  => "Content-Type: application/json\r\n",
            'content' => $payload,
            'timeout' => 10,
            'ignore_errors' => true,
        ],
    ]);

    $response = file_get_contents('https://verify.nexlolabs.net/api/challenge/verify', false, $context);
    return json_decode($response, true);
}

Store NLV_SITE_SECRET in your server environment (.env, secrets manager) — never hardcode it in source or expose it to the browser.