# Quick Start
Capcat is a hosted human verification service: you don't need to deploy or maintain any backend. Create a site in the console to get your keys, drop the **frontend widget** into your page, and have your backend call one **verification endpoint**. The whole integration takes about 5 minutes.
[See it live first →](https://capcat.ai/guide/demo.md)
## 1. Create a site and get your keys
Open [console.capcat.ai](https://console.capcat.ai), sign up with an email and password, then click "New site". You'll get two keys:
- **site key** — public value, embedded in your page code;
- **secret** — private value, shown only once at creation time, used by your backend to call the verification endpoint.
After creating your site, we recommend you [bind a domain](https://capcat.ai/guide/console.md#_3-bind-a-domain-strongly-recommended) right away to prevent others from using your site key.
## 2. Add the widget to your page
The widget is a standalone Web Component, loaded via a single `
```
Placed inside a `
```
Just replace `` with the site key from your console. For SPAs or custom flows, see the [widget guide](https://capcat.ai/guide/widget.md).
## 3. Verify the token on your server
Before trusting any submission, send the token to `/siteverify` for verification:
```sh
curl "https://api.capcat.ai//siteverify" \
-X POST \
-H "Content-Type: application/json" \
-d '{ "secret": "", "response": "" }'
```
A successful verification returns:
```json
{ "success": true }
```
The token is single-use — it becomes invalid after one verification. For examples in more languages, see the [server-side verification API](https://capcat.ai/guide/siteverify.md).
> **Note**
>
> `secret` must never appear in frontend code — it belongs only on your server. If it's compromised, you can rotate it in the console (the old secret stays valid for a 1-hour grace period).
## 4. End-to-end check
1. Open the page — the checkbox should tick automatically, and a `cap-token` field should appear in the form;
2. Send the token to `/siteverify` — it should return `{ "success": true }`;
3. Send the same token again — it should fail, confirming that the single-use mechanism works.
## API and migration
`/siteverify` is API-compatible with reCAPTCHA / hCaptcha: migrating from them usually just means changing one URL on the backend and swapping the frontend widget for ``. Capcat is built on the open-source project [Cap](https://github.com/tiagozip/cap) (Apache 2.0).