Quick Start

Capcat is a hosted human verification service: you don't need to deploy or maintain any backend. Create a site in the console to get your keys, drop the frontend widget into your page, and have your backend call one verification endpoint. The whole integration takes about 5 minutes.

See it live first →

1. Create a site and get your keys

Open console.capcat.ai, sign up with an email and password, then click "New site". You'll get two keys:

• site key — public value, embedded in your page code;
• secret — private value, shown only once at creation time, used by your backend to call the verification endpoint.

After creating your site, we recommend you bind a domain right away to prevent others from using your site key.

2. Add the widget to your page

The widget is a standalone Web Component, loaded via a single <script> tag:

<script src="https://capcat.ai/widget/cap.js" defer></script>

Placed inside a <form>, it works without any JavaScript — the widget automatically injects a hidden cap-token field that gets submitted along with the form:

<form action="/submit" method="POST">
  <!-- your form fields -->
  <cap-widget data-cap-api-endpoint="https://api.capcat.ai/<site-key>/"></cap-widget>
  <button type="submit">Submit</button>
</form>

Just replace <site-key> with the site key from your console. For SPAs or custom flows, see the widget guide.

3. Verify the token on your server

Before trusting any submission, send the token to /siteverify for verification:

curl "https://api.capcat.ai/<site-key>/siteverify" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{ "secret": "<secret>", "response": "<captcha_token>" }'

A successful verification returns:

{ "success": true }

The token is single-use — it becomes invalid after one verification. For examples in more languages, see the server-side verification API.

Note

secret must never appear in frontend code — it belongs only on your server. If it's compromised, you can rotate it in the console (the old secret stays valid for a 1-hour grace period).

4. End-to-end check

1. Open the page — the checkbox should tick automatically, and a cap-token field should appear in the form;
2. Send the token to /siteverify — it should return { "success": true };
3. Send the same token again — it should fail, confirming that the single-use mechanism works.

API and migration

/siteverify is API-compatible with reCAPTCHA / hCaptcha: migrating from them usually just means changing one URL on the backend and swapping the frontend widget for <cap-widget>. Capcat is built on the open-source project Cap (Apache 2.0).