Private Access Tokens: A Quiet End to CAPTCHAs on Apple Devices
Cloudflare today announced Private Access Tokens (PATs), a new cryptographic mechanism that lets supported devices prove they belong to a real human without any visible challenge or data collection. For visitors on upcoming versions of iOS, iPadOS, and macOS, this means CAPTCHAs effectively disappear. Cloudflare says the technology will eliminate nearly 100% of CAPTCHAs served to users on those platforms.
The system is built on an extension of the Privacy Pass protocol, developed jointly by Cloudflare, Apple, Google, and other industry partners. PATs are designed to work not just in browsers, but also for APIs called by browsers and within native applications. Cloudflare has already integrated the technology into its Managed Challenge platform, meaning existing customers who use that feature will automatically benefit without configuration changes.
Why Mobile Breaks CAPTCHAs
CAPTCHAs were built for the desktop browser era, and the mismatch is stark on mobile. Widgets and iframes render poorly on small screens, JavaScript and image loading consume bandwidth and delay page loads, and the input areas are often partially obscured. The technology simply wasn't designed for small touch interfaces.
The problem extends beyond usability. Mobile traffic is increasingly API-driven, and CAPTCHAs cannot function in API environments where JavaScript can't render or WebViews can't be invoked. Developers who need to challenge users in native apps are left with clunky SDKs that must be embedded, customized, and maintained—a burden that often leads to higher abandonment rates. In practice, Cloudflare customers show CAPTCHAs on mobile only 20% of the time, a figure that reflects these limitations rather than a lack of mobile threats.
The Privacy Problem with Alternatives
When a CAPTCHA isn't viable, many site operators fall back on fingerprinting—collecting device identifiers, screen sizes, fonts, and interaction patterns to gauge whether a visitor is legitimate. That approach is invasive, expensive to implement, and ultimately collects far more data than is needed. System-level validation APIs such as Apple's DeviceCheck and Android's SafetyNet offer a more respectable alternative, but they require significant application and server-side changes and suffer from the same maintenance burden as SDKs.
Private Access Tokens address both problems by removing the need to interrogate the device at all. Instead, the device vendor—who already possesses the relevant attestation data—performs the validation. The website or API receives only a cryptographic confirmation that the device is authentic.
The data compartmentalization is strict. In a traditional CAPTCHA setup, the CAPTCHA provider typically sees the site you're visiting, your IP address, device information, and interaction data—and can correlate that across sites. With PATs, the device manufacturer (attester) sees only the device data needed for attestation, with no knowledge of the destination site or IP. Cloudflare, acting as the origin or issuer, knows the site but receives none of the device or interaction data.
Four Parties, One Token
Private Access Tokens require four distinct roles to cooperate:
- Origin: The website or API receiving requests. For Cloudflare customers, Cloudflare handles token requesting and processing on their behalf.
- Client: The browser or application the visitor uses. In Cloudflare's example, Safari on an iPhone.
- Attester: The party that verifies device authenticity. In the initial rollout, this is Apple, the device vendor.
- Issuer: The only party that generates tokens. Cloudflare will serve this role for its customers.
The flow completes without any user interaction. When a visitor requests a page, Cloudflare asks their browser for a token. The browser calls the Apple attester, which validates the device and calls the Cloudflare issuer. The issuer returns a token to the browser, which forwards it to the origin. Cloudflare then verifies the token and skips the CAPTCHA. Critically, the website itself takes no action beyond requesting the token; all validation and issuance happens behind the scenes.
Adoption and Rollout
Apple announced support for Private Access Tokens in iOS 16, iPadOS 16, and macOS 13. Cloudflare expects additional device vendors to announce support soon. For existing Cloudflare customers, the only requirement is enabling Managed Challenge rather than Legacy CAPTCHA in a firewall rule—a configuration already used by more than 65% of customers. Once a visitor upgrades to a supported operating system, CAPTCHAs will automatically stop appearing for that user.
Cloudflare indicates that PATs will be incorporated into other security products in the near future.
