Apple's iOS 16 auto-verification feature is expected to support more sites soon

iOS 16 has a new automatic verification function, which can automatically and privately verify the user's device and Apple ID account through iCloud, thereby bypassing the CAPTCHA prompt. The feature is designed to eliminate the need to prove a user is a real person and not a bot by clicking on traffic light images...etc.

Automatic verification is limited to websites and apps that support private access tokens, but the adoption of the feature should be heavily driven by Cloudflare. Cloudflare announced today that it will offer a free API called Turnstile to any website looking to eliminate captchas—even if the website isn't a Cloudflare customer.

Cloudflare explained how the technology works in a blog post:

Private access tokens are built directly into Turnstile. While Turnstile has to look at some session data (such as headers, user-agent, and browser characteristics) to authenticate users, private access tokens allow us to minimize data collection by asking Apple to authenticate the device for us. Additionally, Turnstile never looks for cookies (such as login cookies), or uses cookies to collect or store any type of information.

As of today, Turnstile begins beta testing via the Cloudflare dashboard or signup form.

Automatic verification is enabled by default on iPhones running iOS 16 and can be found under Settings - Apple ID - Password & Security - Automatic Verification. The feature is also supported in iPadOS 16.1 and macOS Ventura, which are still in beta testing and due for release in October, Apple said.