Secure your forms with Captcha API

1. Platform Overview & Business Architecture

The Captcha API is a privacy-first, developer-friendly bot detection service. Traditional CAPTCHA systems rely on frustrating image identification grids or text deciphering tasks that interrupt the user journey and hurt conversion rates. This API solves this problem by using behavioral heuristics, mouse movements, environment fingerprinting, and machine learning models to identify bots in the background.

When a user interacts with your webpage, a small client-side script monitors non-invasive telemetry signals. Once the form is submitted, the script generates a secure token, which your backend verifies by calling the Captcha API. The gateway returns a simple success flag and a detailed risk score between 0.0 (high bot risk) and 1.0 (human).

This system complies with global privacy regulations (such as GDPR and CCPA) because it does not track personal user data, set persistent tracking cookies, or build user profiling maps.

2. Bot Detection Features

3. API Reference & Technical Endpoints

The Captcha verification API communicates via secure HTTPS POST requests. Below are the request and response specifications.

{
  "token": "cap_token_98471abc092183d74f82910a2",
  "remoteip": "198.51.100.5",
  "expected_action": "login_submit"
}

{
  "success": true,
  "score": 0.92,
  "action": "login_submit",
  "challenge_ts": "2026-08-19T06:12:30Z",
  "hostname": "devsecit.com",
  "error_codes": []
}

4. Step-by-Step Integration Guide

To protect your forms, you must integrate our library into both your frontend page and backend verification flow:

Step 1: Frontend Script Integration

Include our client-side script and call the token generation function before submitting your forms:

<script src="https://console.devsecit.com/sdk/captcha.js?sitekey=YOUR_SITE_KEY" async defer></script>
<script>
  function onSubmitForm(e) {
    e.preventDefault();
    dsiCaptcha.execute('login_submit').then(function(token) {
       document.getElementById('captcha_token').value = token;
       document.getElementById('login_form').submit();
    });
  }
</script>

Step 2: Backend Token Validation

Extract the token from the form POST data, and verify it by sending a POST request to our validation endpoint as shown in Section 3. Block the request if the returned score is below your safety threshold (e.g., 0.5).

5. Security, High-Availability & Privacy Compliance

Protecting forms against automated attacks requires maintaining a secure and reliable platform:

• Encrypted Payload Tokens: Verification tokens are encrypted with a time-bounded key and expire within 2 minutes of generation to prevent token reuse attacks.
• High-Speed Verification Network: Our globally distributed server cluster processes verification requests with latency under 30ms, preventing form submission delays.
• Strict Rate-Limiting: Captcha submission endpoints use advanced rate limiting to protect your servers from credential stuffing attacks.
• Compliance & Accessibility: Because the bot detection runs silently, the system is fully accessible out of the box, complying with Web Content Accessibility Guidelines (WCAG).

6. Enterprise Use Cases

7. FAQ & Troubleshooting Guide