Frictionless Analysis
Verify users without showing annoying image grids. The analysis runs silently in the background.
Privacy-First Bot Detection
Secure your forms with Captcha API
Protect your forms and endpoints from bots and spam. Our Captcha API uses behavioral analysis and risk scoring to verify users without requiring frustrating image puzzles.
Captcha Verifier
● System ProtectedPOST /api/v1/captcha/verify HTTP/1.1
Host: console.devsecit.com
Authorization: Bearer DSI_CAP_...
Content-Type: application/json
// Request Payload
{
"token": "cap_token_98471abc...",
"remoteip": "198.51.100.1"
}
Frictionless validation
Privacy-Friendly (No Cookies)
1. Platform Overview & Business Architecture
The Captcha API is a privacy-first, developer-friendly bot detection service. Traditional CAPTCHA systems rely on frustrating image identification grids or text deciphering tasks that interrupt the user journey and hurt conversion rates. This API solves this problem by using behavioral heuristics, mouse movements, environment fingerprinting, and machine learning models to identify bots in the background.
When a user interacts with your webpage, a small client-side script monitors non-invasive telemetry signals. Once the form is submitted, the script generates a secure token, which your backend verifies by calling the Captcha API. The gateway returns a simple success flag and a detailed risk score between 0.0 (high bot risk) and 1.0 (human).
This system complies with global privacy regulations (such as GDPR and CCPA) because it does not track personal user data, set persistent tracking cookies, or build user profiling maps.
Capabilities
2. Bot Detection Features
Advanced Risk Engine
Analyze environment signals, connection latency, and behavioral patterns to generate a precise risk score.
GDPR/CCPA Compliant
Protect user privacy. Our system does not use tracking cookies or compile personal user histories.
Custom Challenge Action
Configure fallback behaviors to request manual verification only when the background risk score is highly ambiguous.
HTTP Request (POST)Verify captcha token
POST https://console.devsecit.com/api/v1/captcha/verify
Header "Authorization: Bearer YOUR_CAPTCHA_PRIVATE_TOKEN"
Header "Content-Type: application/json"
Request Payload (Body JSON)Body
{
"token": "cap_token_98471abc092183d74f82910a2",
"remoteip": "198.51.100.5",
"expected_action": "login_submit"
}Successful Response Payload200 OK
{
"success": true,
"score": 0.92,
"action": "login_submit",
"challenge_ts": "2026-08-19T06:12:30Z",
"hostname": "devsecit.com",
"error_codes": []
}API reference
3. API Reference & Technical Endpoints
The Captcha verification API communicates via secure HTTPS POST requests. Below are the request and response specifications.
Frontend Script (HTML)dsiCaptcha.execute
<script src="https://console.devsecit.com/sdk/captcha.js?sitekey=YOUR_SITE_KEY" async defer></script>
<script>
function onSubmitForm(e) {
e.preventDefault();
dsiCaptcha.execute('login_submit').then(function(token) {
document.getElementById('captcha_token').value = token;
document.getElementById('login_form').submit();
});
}
</script>Integration
4. Step-by-Step Integration Guide
To protect your forms, you must integrate our library into both your frontend page and backend verification flow:
Step 1: Frontend Script Integration
Include our client-side script and call the token generation function before submitting your forms:
Step 2: Backend Token Validation
Extract the token from the form POST data, and verify it by sending a POST request to our validation endpoint as shown in Section 3. Block the request if the returned score is below your safety threshold (e.g., 0.5).
Security
5. Security, High-Availability & Privacy Compliance
Protecting forms against automated attacks requires maintaining a secure and reliable platform:
Encrypted Payload Tokens:
Verification tokens are encrypted with a time-bounded key and expire within 2 minutes of generation to prevent token reuse attacks.
High-Speed Verification Network:
Our globally distributed server cluster processes verification requests with latency under 30ms, preventing form submission delays.
Strict Rate-Limiting:
Captcha submission endpoints use advanced rate limiting to protect your servers from credential stuffing attacks.
Compliance & Accessibility:
Because the bot detection runs silently, the system is fully accessible out of the box, complying with Web Content Accessibility Guidelines (WCAG).
Use cases
6. Enterprise Use Cases
Where teams deploy the Captcha API:
User Signup Protection
Block automated scripts from creating fake customer accounts or registering placeholder emails during sign-up flows.
Credential Stuffing Defense
Secure login screens against automated brute-force attacks, protecting user accounts from hijacking attempt arrays.
E-commerce Checkout Protection
Prevent inventory scalping bots from locking products in shopping carts or executing fraudulent orders.
API Documentation
Captcha Verification API
- Under 25 Milliseconds
- 2 minutes
- GDPR, CCPA, WCAG AAA Accessible
- console.devsecit.com
Served by the globally distributed server cluster.
Time-bounded verification keys prevent token reuse attacks.
Supported SDKs: React, Vue, NextJS, Python, PHP.
Risk score runs 0.0 (high bot risk) to 1.0 (human).
Troubleshooting
7. FAQ & Troubleshooting Guide
How does the system determine the risk score?
The risk engine evaluates variables like mouse movements, connection headers, and request latency to identify automation patterns.
Does this CAPTCHA set cookie tracking tokens?
No. It uses cookieless browser environment check techniques, ensuring full compliance with GDPR cookie consent regulations.
What happens if a legitimate user gets a low safety score?
You can configure the system to trigger a secondary, accessible verification step (such as a simple checkbox challenge) if a score is borderline.
What is the optimal risk threshold setting for form submissions?
We recommend a default threshold of 0.5. You can adjust this setting dynamically in your portal dashboard based on your form security requirements.
Get started
Deploy Privacy-First Bot Protection
Secure your websites, block registration spam, and stop brute-force attacks using DEV SEC IT Captcha APIs.