async function palmynVerify(token) {
  const url = new URL('https://TU_DOMINIO.com/api/captcha.php');
  url.searchParams.set('q',      'siteverify');
  url.searchParams.set('secret', process.env.PALMYN_SECRET_KEY);
  url.searchParams.set('token',  token);

  const res  = await fetch(url.toString());
  const data = await res.json();

  if (!data.success) {
    throw new Error('Palmyn: ' + (data['error-codes'] || []).join(', '));
  }
  return data;
}

// Middleware example
async function requirePalmyn(req, res, next) {
  try {
    req.palmyn = await palmynVerify(req.body.palmyn_token || '');
    next();
  } catch (err) {
    res.status(403).json({ error: err.message });
  }
}

app.post('/submit', requirePalmyn, (req, res) => {
  console.log('Score:', req.palmyn.score);
  res.json({ ok: true });
});

import os
import requests
from functools import wraps
from flask import request, abort, g

PALMYN_API = "https://TU_DOMINIO.com/api/captcha.php"

def palmyn_verify(token: str) -> dict:
    r = requests.get(
        PALMYN_API,
        params={
            "q":      "siteverify",
            "secret": os.environ["PALMYN_SECRET_KEY"],
            "token":  token,
        },
        timeout=5,
    )
    data = r.json()
    if not data.get("success"):
        codes = ", ".join(data.get("error-codes", ["unknown"]))
        raise ValueError(f"Palmyn: {codes}")
    return data

# Decorator for Flask routes
def require_palmyn(f):
    @wraps(f)
    def wrapper(*args, **kwargs):
        token = request.form.get("palmyn_token") or request.json.get("palmyn_token", "")
        g.palmyn = palmyn_verify(token)
        return f(*args, **kwargs)
    return wrapper

@app.route("/submit", methods=["POST"])
@require_palmyn
def submit():
    print("Score:", g.palmyn["score"])
    return {"ok": True}

// routes/auth.js
app.post('/auth/palmyn/callback', async (req, res) => {
  try {
    const url = new URL('https://TU_DOMINIO.com/api/captcha.php');
    url.searchParams.set('q',      'siteverify');
    url.searchParams.set('secret', process.env.PALMYN_SECRET_KEY);
    url.searchParams.set('token',  req.body.token || '');

    const data = await fetch(url.toString()).then(r => r.json());

    if (!data.success) throw new Error('Verification failed');

    const { human_id, email, verified_level } = data;

    // Only allow biometric-verified users
    if (verified_level < 2) {
      return res.status(403).json({ error: 'Biometric verification required' });
    }

    // Upsert user in your DB
    const user = await prisma.user.upsert({
      where:  { palmynId: human_id },
      create: { palmynId: human_id, email },
      update: {},
    });

    // Set session
    req.session.userId = user.id;
    res.json({ redirect: '/dashboard' });

  } catch (err) {
    res.status(403).json({ error: err.message });
  }
});

# views/auth.py
import os, requests
from flask import request, session, redirect, abort

@app.route("/auth/palmyn/callback", methods=["POST"])
def palmyn_callback():
    token = (request.json or {}).get("token", "")

    r = requests.get(
        "https://TU_DOMINIO.com/api/captcha.php",
        params={
            "q":      "siteverify",
            "secret": os.environ["PALMYN_SECRET_KEY"],
            "token":  token,
        },
        timeout=5,
    )
    data = r.json()

    if not data.get("success"):
        abort(403, "Verification failed")

    human_id       = data["human_id"]         # "hid_..."
    email          = data["email"]             # "user@example.com"
    verified_level = int(data["verified_level"])  # 0 | 1 | 2

    if verified_level < 2:
        abort(403, "Biometric verification required")

    # Upsert user in your DB
    user = User.query.filter_by(palmyn_id=human_id).first()
    if not user:
        user = User(palmyn_id=human_id, email=email)
        db.session.add(user)
        db.session.commit()

    session["user_id"] = user.id
    return {"redirect": "/dashboard"}