> For the complete documentation index, see [llms.txt](https://dataroom.mercle.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dataroom.mercle.ai/what-why-how.md).

# What Why How?

Learn about the overview of Mercle.

### Why now?

The internet can no longer reliably tell who is human. In 2025, non-human (bot) requests to web pages surpassed human traffic for the first time in a decade, hitting 51% globally — and climbing into 2026. Unverified bot traffic grew 76% year over year. AI agents accelerated this, quadrupling in 2025 and hitting 7.9B requests in early 2026 alone. 

Most of the defenses still in wide use were designed for an older internet. CAPTCHAs, simple pattern rules, rate limits, device fingerprints, and user-agent checks assumed bots were fragile, straightforward to spot, and costly to run. That assumption has collapsed. [Cloudflare’s](https://blog.cloudflare.com/web-bot-auth/) position is blunt, “existing bot verification mechanisms are broken,” and the company is pointing toward cryptographic authentication because agents increasingly move through the same front doors that humans do.

[DataDome’s 2026 findings](https://cpl.thalesgroup.com/about-us/newsroom/vulnerable-apis-bot-attacks-costing-businesses-186-billion) show what that looks like in practice. In its study, close to 80% of AI agents didn’t identify themselves correctly, and 79.7% of the websites tested let a spoofed agent pass without a block or even a challenge. This is already hitting budgets and business outcomes, not just engineering backlogs. [Thales/Imperva](https://cpl.thalesgroup.com/about-us/newsroom/vulnerable-apis-bot-attacks-costing-businesses-186-billion) estimate that API insecurity and bot attacks cost companies as much as $186 billion each year, and automated bot abuse alone ties to up to $116 billion in losses. Imperva’s 2025 Bad Bot Report adds the operational detail, these attacks work through business logic, they go after APIs, and they scale fraud efficiently. For platforms, the symptoms are familiar: revenue leakage, weaker trust, higher moderation spend, and marketplaces that no longer reflect real supply and demand.

At the same time, AI is becoming a new interface layer for how work gets done online. OpenAI’s Operator is built to run its own browser, typing, clicking, scrolling, and completing tasks for users. Anthropic’s computer-use models are aimed at the same idea, interacting with software by moving a cursor and entering information the way a person would. [Gartner predicts](https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025) that by the end of 2026, **40% of enterprise applications** will ship with built-in, task-focused AI agents. In parallel, Visa is putting agentic-commerce plumbing in place so agents can make purchases for users with authentication, controls, and agent-specific payment credentials.

Together, these shifts open a trust gap. Verifying the software actor is no longer sufficient. More often, applications need to confirm the human principal behind the software that is acting. [MIT researchers, alongside contributors from OpenAI, Microsoft, and others](https://arxiv.org/pdf/2408.07892), frame this as personhood credentials, privacy-preserving ways to prove you are a real person online without disclosing who you are. That layer is what an agent-driven internet is missing, software can take action, but rights, reputation, and accountability still have to map back to real people.

> **KYC is a compliance primitive. Proof of human is a product primitive.**

KYC exists for regulated relationships where a platform must know a user’s legal identity. Proof of human addresses a different requirement, it allows an application to confirm that an account, or an agent operating through that account, is backed by a real and distinct person. That’s what products need for trusted delegation, one-person-per-account rules, and clear human accountability online.

Mercle gives applications a privacy-preserving way to verify humanness and uniqueness, the trust layer missing from the agentic internet.

***

### How ?

From ‌an ‌end-user’s ‌point of view, the experience is straightforward. A platform adds Mercle much like it adds “Login with Google”, via a standard SDK that runs the full sequence end to end. When the platform needs a person to confirm they’re human, the user is asked to complete a quick face scan in the Mercle mobile app, using the phone’s built-in camera. Once the scan finishes, the user returns to the original action and carries on.

A first-time check typically takes about 1.5 minutes. Later re-checks are much faster, usually around 12 seconds.

#### Verification Flow

When a platform integrates Mercle, it can ask a user to provide **human proof** during any platform action.

The user is prompted to complete a **face verification through the Mercle mobile app**. Once the scan is completed, the user continues with the platform action.

During this process three things happen in a single flow:

1. **Liveness is verified.** Mercle confirms the scan is a live human — not a photo, video replay, or synthetic media.
2. **Uniqueness is verified.** The face is checked against every existing user to confirm this person hasn't already registered on the same application. This check happens entirely on encrypted data raw biometric data is never decrypted, exposed, or stored at any point in the pipeline.
3. **A proof of human is returned to the platform** — without sharing any biometric data or user photos.

In internal benchmarks, Mercle's liveness and uniqueness models have outperformed AWS Rekognition, BioID, and DIDIT (YC). [Detailed benchmark results are available in this report.](https://0xmercle.notion.site/MercleV1-Model-Comparison-30882d1676178072a36ddb5d7604de3e?pvs=73)

#### What the Platform Receives

Once verification is complete, the platform gets a Mercle ID that stands in for a unique human within that application.

This ID is generated per **human + application pair**, which means:

* the same user cannot create multiple identities inside a single platform
* identities cannot be linked across different applications

This prevents cross-platform tracking while still allowing platforms to enforce **one-human-per-account** rules.

By default, Mercle runs on any standard smartphone camera, with no special hardware. For use cases that require higher assurance, Mercle also offers verification centres equipped with a specialized camera that captures richer facial detail for stronger uniqueness detection. Over time, the intent is to move all verification onto consumer devices as the models continue to improve.

Developers integrate through standard APIs via the [Mercle developer portal.](https://id.mercle.ai/)

Try out the app: [Android](https://play.google.com/store/apps/details?id=com.mercle.app) | [iOS](https://apps.apple.com/us/app/mercle/id6751991316)

***

### What is Mercle?

Mercle ‌is ‌proof-of-human ‌infrastructure built for the agentic internet.

At its core is a straightforward, mobile-first face verification process that confirms a person is real, currently present, and unique. It does this without keeping raw biometric data, without depending on specialized hardware, and without forcing someone to reveal their legal identity.

> **KYC tells a platform *****who***** someone is. Mercle tells a platform *****that***** someone is real.**