Get Your Keys (Console)
Capcat is a hosted verification service: you don't need to deploy any backend — just sign up in the console to get your integration keys.
1. Sign up / log in
Open console.capcat.ai and sign up with an email and password; if you already have an account, just log in.
2. Create a site
Click "New site" and enter a site name. The system will generate a pair of keys:
| Key | Purpose | Confidentiality |
|---|---|---|
| site key | Identifies your frontend widget; appears in your page code | Public |
| secret | Used by your backend to call /siteverify | Never expose it; shown only once at creation |
The secret is shown only once
Save the secret immediately when it's created or rotated. It can't be retrieved afterward — you can only rotate it in the console (the old secret stays valid for a 1-hour grace period).
3. Bind a domain (strongly recommended)
In your site's details, under "Domain binding", enter your website's domain. Once bound, only pages served from these domains can use your site key, preventing others from using up your quota.
Supported formats:
example.com— this domain and all its subdomains*.example.com— subdomains onlyhttps://example.com— exact originhttp://localhost:*— local development (any port)
Without a bound domain, any website can use your site key (the console will show a warning). Changes take effect globally within about 1 minute.
4. Integrate
Add the widget on the frontend (see the widget guide for details):
<script src="https://capcat.ai/widget/cap.js" defer></script>
<cap-widget data-cap-api-endpoint="https://api.capcat.ai/<site-key>/"></cap-widget>Verify the token on the backend (see the server-side verification API for details):
curl -X POST https://api.capcat.ai/<site-key>/siteverify \
-H "content-type: application/json" \
-d '{"secret":"<secret>","response":"<cap-token value>"}'Usage & limits
The console shows the verification count, pass rate, and blocked count for each site over the last 7 days. Current default limits: 600 req/min per site, 30 req/min per IP; exceeding them returns HTTP 429. Contact us if you need a higher quota.