Laravel

'blockalt' => [
    'secret' => env('BLOCKALT_SECRET'),
    'hostname' => env('BLOCKALT_HOSTNAME', 'example.com'),
],

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Client\ConnectionException;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;

class VerifyBlockAlt
{
    public function handle(Request $request, Closure $next, string $action)
    {
        try {
            $response = Http::timeout(3)
                ->withoutRedirecting()
                ->withToken(config('services.blockalt.secret'))
                ->post('https://blockalt.click/v1/siteverify', [
                    'token' => (string) $request->input('blockalt-token', ''),
                    'hostname' => config('services.blockalt.hostname'),
                    'action' => $action,
                ]);
        } catch (ConnectionException) {
            abort(403, 'Please try again.');
        }
        if (! $response->ok() || $response->json('success') !== true) {
            Log::warning('blockalt refused', ['reason' => $response->json('reason'), 'id' => $response->json('id')]);
            abort(403, 'Please try again.');
        }

        return $next($request);
    }
}

->withMiddleware(function (Middleware $middleware) {
    $middleware->alias(['blockalt' => \App\Http\Middleware\VerifyBlockAlt::class]);
})

Route::post('/register', [RegisterController::class, 'store'])->middleware('blockalt:signup');

<script src="https://blockalt.click/v1/assets/blockalt.c8b2d9539dbbc932999adb0f51a36bddd4e99899f543e1505818841878cf9813.js"
  integrity="sha384-pblByFDqcJxRfhDh18GH3gRsWy9ZaS4AjDc6OpozzQqvkuYvyin+4BWcKXxA+bN8"
  crossorigin="anonymous"></script>
<script src="{{ asset('js/signup.js') }}" defer></script>

<form id="signup" method="POST" action="/register">
  @csrf
  <input name="blockalt-token" type="hidden">
  …
</form>