Two files. One call each side.

import { FaceGUIDServer } from 'https://faceguid.com/sdk/faceguid-server.js';

export default {
  async fetch(request, env) {
    const fg = new FaceGUIDServer({
      clientId: env.FACEGUID_CLIENT_ID,
      clientSecret: env.FACEGUID_CLIENT_SECRET,
    });

    const { token } = await request.json();
    try {
      const proof = await fg.verifyProof(token);
      return Response.json({ ok: true, sub: proof.sub });
    } catch (err) {
      return Response.json({ error: err.code }, { status: 403 });
    }
  },
};

// app/api/human/route.js  —  Next.js route handler
import { FaceGUIDServer } from '@/lib/faceguid-server';   // vendored copy of the SDK

const fg = new FaceGUIDServer({
  clientId: process.env.FACEGUID_CLIENT_ID,
  clientSecret: process.env.FACEGUID_CLIENT_SECRET,
});

export async function POST(request) {
  const { token, nonce } = await request.json();
  try {
    const proof = await fg.verifyProof(token, { nonce });
    return Response.json({ ok: true, sub: proof.sub });
  } catch (err) {
    return Response.json({ error: err.code }, { status: 403 });
  }
}

# No SDK needed: it is one authenticated POST.
import os, requests

def verify_proof(token: str, nonce: str | None = None) -> dict:
    res = requests.post(
        "https://faceguid.com/api/proof/verify",
        auth=(os.environ["FACEGUID_CLIENT_ID"], os.environ["FACEGUID_CLIENT_SECRET"]),
        json={"token": token, "nonce": nonce},
        timeout=5,
    )
    body = res.json()
    if res.status_code != 200 or not body.get("human"):
        raise ValueError(body.get("error", "proof_rejected"))
    return body            # sub, verifications, enrolled_at, acr, amr, jti

# Django / Flask view
def human_required(view):
    def wrapper(request, *a, **kw):
        try:
            request.human = verify_proof(request.headers["X-FaceGUID-Proof"])
        except (KeyError, ValueError):
            return HttpResponseForbidden()
        return view(request, *a, **kw)
    return wrapper

<?php
// Same call, no dependencies.
function faceguid_verify(string $token, ?string $nonce = null): array {
    $ch = curl_init('https://faceguid.com/api/proof/verify');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_USERPWD        => getenv('FACEGUID_CLIENT_ID') . ':' . getenv('FACEGUID_CLIENT_SECRET'),
        CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
        CURLOPT_POSTFIELDS     => json_encode(['token' => $token, 'nonce' => $nonce]),
    ]);
    $body = json_decode(curl_exec($ch), true);
    if (empty($body['human'])) {
        throw new RuntimeException($body['error'] ?? 'proof_rejected');
    }
    return $body;
}

# Verify a proof. This is the whole server-side integration.
curl -X POST https://faceguid.com/api/proof/verify \
  -u "$FACEGUID_CLIENT_ID:$FACEGUID_CLIENT_SECRET" \
  -H "content-type: application/json" \
  -d '{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6ImZhY2VndWlkLXByb29mK2p3dCJ9..."}'

# {
#   "human": true,
#   "sub": "6f1c2d0e-9a3b-4c7d-8e21-5b0a9f3c1d84",
#   "nonce": "b7f2…",
#   "amr": ["face", "liveness"],
#   "acr": "faceguid:liveness:speak-digits",
#   "auth_time": 1766745600,
#   "enrolled_at": 1740873600,
#   "verifications": 37,
#   "second_factor": false,
#   "new_identity": false,
#   "expires_at": 1766745900,
#   "jti": "0c2f…"
# }

# Spending it a second time is refused — that is the replay guard.
# HTTP 409  {"human":false,"error":"token_already_used"}