Sneaker drops + raffles, how do you stop bots and keep it fair?

Bots are the existential threat to sneaker drops. Without anti-bot, ~85% of a hyped drop goes to resellers in the first 30 seconds. With it, genuine-customer purchase rate runs ~70%. The stack:

• Cloudflare Turnstile, free, privacy-preserving CAPTCHA. Blocks ~95% of headless-browser bots. Drop it on add-to-cart and checkout. Magento module is a quick custom plugin (no marketplace extension yet, ~$2k of dev).
• hCaptcha, alternative, slightly more aggressive. Better at catching residential-proxy farms. Paid (~$0.0001 per check at scale). Magento extension exists.
• Raffle entry, replace first-come-first-served with a 24-hour entry window, random winner draw, SMS + email notification with a 4-hour purchase window. Eliminates the bot speed advantage entirely. Magento integration: custom raffle module (custom product type + lottery cron).
• Account-age + verification, require an account >7 days old + phone-verified for raffle entry. Cuts throwaway-account farming.
• Stock reservations + payment-vault tokenization, same as the fashion-drops pattern. Reserve stock at add-to-cart, charge only on successful order. Prevents the “Stripe-charged-but-out-of-stock” mass-refund event.
• Pre-warmed cache + Cloudflare, Hyvä cache pre-warmed 30 min before, Cloudflare in front for the traffic spike, cron-scheduled category visibility flip at the drop instant + cache purge.

The war-room: 3-person team on the first 3 drops post-launch. Anti-bot dashboard, payment-gateway status, real-time inventory monitoring, manual cron-trigger fallback. Most failure modes show up in the first 90 seconds.