We'd rather not solve CAPTCHAs

Suppose you ask an agent to download an invoice from a supplier portal. You have an account, permission to retrieve it, and the supplier supports the automated workflow through its website.

The agent signs in, finds the document, and encounters a CAPTCHA. A solver can handle the challenge, but it adds a wait, can fail, and may require another attempt before the agent can retrieve the invoice.

At Notte, we'd prefer the website to recognize an authorized agent and let it finish. We want approaches like Web Bot Auth to become a normal part of web access.

Give websites something they can verify

An agent retrieving an invoice and a bot attempting account abuse can both arrive through a browser. Detecting automation doesn't tell the operator who is responsible for it or whether its actions are authorized.

Web Bot Auth uses cryptographic signatures on HTTP requests to authenticate bot identity. Participating websites can use that identity in access decisions, as Cloudflare describes in its explanation of message signatures and verified bots.

A valid signature doesn't establish that a user authorized a purchase or that a website permits a workflow. Those permissions still need to exist separately. Users should control what they delegate, and websites should decide which interactions they accept.

The transition happens one website at a time

The invoice portal might have an API that doesn't expose the document the user needs. Its application team and security provider may work on different release schedules. A developer building across several services cannot resolve adoption alone: their workflow may need to combine APIs and signed requests with browser interactions on sites that have no other route for the authorized task.

Why we still build CAPTCHA handling

Solvers let us handle supported challenges while access methods change. We'd happily need them less: detection, solving, and checking whether the workflow can proceed all take time. The user only asked for an invoice.

We prefer a supported API or verified access path where it serves the task. When that path involves a CAPTCHA, we need to handle it reliably and report when the task cannot proceed. An unsolved challenge cannot become an endless loop of attempts.

Success is a completed task

After the checkbox turns green, the agent still needs to check that the document downloaded. A form workflow needs to preserve the user's information and submit once, even if the page changes during solving.