Abstract: An authentication system of a service generates a session corresponding to a browser of a client device in response to the browser accessing a webpage of the service. Through the webpage, the authentication system presents a security challenge and an option for requesting a bypass to the security challenge. In response to selection of the option, the authentication system establishes a communications session between the client device and a service agent that can verify the identity of a user of the client device. If the identity of the user is verified, the service agent can request issuance of a bypass token usable to bypass the security challenge. If a request is received from the service agent, the bypass token is generated and issued to the client device. The client device uses the bypass token to remove the security challenge from the webpage without the user providing the correct response.