Anonyme Mensch-Tokens mit verifizierter Rolle.

<!-- Button on your page -->
<button id="confirm-human">✓ Confirm anonymously</button>

<script>
document.getElementById('confirm-human').onclick = async () => {
  // 1. Get a token from the user's Privacy Pass wallet
  const token = await window.hhttpsWallet.take();

  // 2. Send to YOUR backend — never trust the client result
  const ok = await fetch('/api/confirm-human', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token })
  }).then(r => r.ok);

  if (ok) showSuccess('✓ Confirmed as human — anonymous');
};
</script>

app.post('/api/confirm-human', async (req, res) => {
  const r = await fetch('https://hhttps.org/privacy-pass/redeem', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token: req.body.token })
  });
  const d = await r.json();

  // d.valid && d.redeemed          → genuine human, token used once
  // d.reason === 'already_redeemed' → token already used (double-spend)
  // d.role                          → attested role (optional)
  res.sendStatus(d.valid && d.redeemed ? 200 : 403);
});