CAPTCHA challenge service

Design a CAPTCHA / challenge service that protects high-value endpoints (signup, login, checkout, password reset) across many customer websites, issuing 1M challenges/s globally with under 100ms to render a challenge token. Threat model: automated solvers, cheap human CAPTCHA-farms, and token replay/sharing. Goals: stop bots while keeping friction near-zero for real humans (accessibility matters), and stop a solved token from being reused or transferred. Cover the challenge types, the verification/token flow, replay/transfer protection, and the score-vs-block decision.