Cloudflare Turnstile widget with appearance interaction-only

#!/usr/bin/env bash
# Solve this page's Cloudflare Turnstile widget with createTask, then check the token here.
set -euo pipefail
API=${ZEROCAPTCHA_API:-https://api.zerocaptcha.io}
KEY=${ZEROCAPTCHA_KEY:?Set ZEROCAPTCHA_KEY to your API key, zc_live_..., from the dashboard.}

# 1. createTask for this page and its sitekey.
#    This widget sets no data-action or data-cdata. For one that does, send both, or a site
#    that checks them refuses the token: add metadata: {action: "login", cdata: "session-7f3a9c2e"}.
#    To solve through your own proxy, make the type TurnstileTask and add
#    proxy: "http://user:pass@proxy.example.net:8080" to the task.
#    CALLBACK_URL, when set, is called with the result when the task ends.
BODY=$(jq -n --arg key "$KEY" --arg callback "${CALLBACK_URL:-}" '{
  clientKey: $key,
  task: {
    type: "TurnstileTaskProxyless",
    websiteURL: "https://zerocaptcha.io/captcha-test/cloudflare-turnstile-interaction-only",
    websiteKey: "0x4AAAAAAFMVDQUY9ZAPO0ni"
  },
  callbackUrl: (if $callback == "" then null else $callback end)
}')
CREATED=$(curl -sS --fail-with-body "$API/createTask" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d "$BODY")
# errorId 1 is a refusal: errorCode and errorDescription say why.
if [ "$(jq -r .errorId <<<"$CREATED")" != 0 ]; then echo "$CREATED" >&2; exit 1; fi
TASK_ID=$(jq -r .taskId <<<"$CREATED")

# 2. getTaskResult every 2 seconds until the task is ready; errorId 1 means it failed, unpaid.
while :; do
  sleep 2
  RESULT=$(curl -sS --fail-with-body "$API/getTaskResult" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg key "$KEY" --arg id "$TASK_ID" '{clientKey: $key, taskId: $id}')")
  if [ "$(jq -r .errorId <<<"$RESULT")" != 0 ]; then echo "$RESULT" >&2; exit 1; fi
  if [ "$(jq -r .status <<<"$RESULT")" = ready ]; then break; fi
done
TOKEN=$(jq -r .solution.token <<<"$RESULT")

# 3. Use solution.token once, within 300 seconds: here, this page's check, which asks
#    Cloudflare's siteverify. Or paste it into the token box on the page.
curl -sS --fail-with-body "$API/v1/demo/verify" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg token "$TOKEN" '{widget: "managed", token: $token}')"