P1
Prove an email is yours
Sign up with a one-time code — no link, no password.
- 1
Enter your email and pass the bot check.
Turnstile blocks scripted signups before we ever send a code or spend an email from the shared daily cap.
- 2
Receive a 6-digit code and type it back.
A code (not a link) proves you control the mailbox; middleboxes that pre-fetch links can’t burn a code they never see.
- 3
You’re verified — a session cookie is set.
The code is single-use and SHA-256-hashed at rest, so the database never holds a code anyone could replay.
Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.
Loading…