aiCaptcha
Get started

Getting started

Introduction

Welcome to aiCaptcha — an AI-powered, privacy-friendly CAPTCHA that never asks visitors to click traffic lights. While a real human interacts with your page, the widget analyzes behavioral signals in the background and produces an explainable verdict: human or bot, with a score from 0 to 1.

Adding it to a website takes minutes: one script tag, one div, one server-side call. No puzzles, no third-party trackers beyond the verification itself, and every verdict comes with the reasons behind it — visible in your dashboard.

How it works

aiCaptcha sits between your visitor and your server. The whole exchange looks like this:

  1. 1

    Visitor's browser

    The widget silently collects behavioral signals — mouse entropy, keystroke rhythm, environment.

  2. 2

    Widget → aiCaptcha API

    Signals are scored by the AI engine and exchanged for a one-time token, valid 2 minutes.

  3. 3

    Visitor → your server

    The token rides along in the form as the ai-captcha-response field when the visitor submits.

  4. 4

    Your server → aiCaptcha API

    Your backend sends the token + secret key to verify-token and gets the final verdict + score.

Invisible to humans, loud for bots

Real visitors never see a challenge — verification completes on its own within a couple of seconds. Automated clients (headless browsers, curl, scripting libraries) fail the behavioral analysis and receive a low score instead.

Key concepts

ConceptDescription
SiteA registered domain in your dashboard (e.g. example.com). Each site has its own pair of keys.
Site keyPublic identifier (IZAAAAA…) embedded in your HTML next to the widget.
Secret keyPrivate key (dIZAAAAA…) used only by your server to call verify-token. Never put it in frontend code.
TokenOne-time string placed in the hidden ai-captcha-response field. Valid 2 minutes, single site, verified once.
Score0–1 confidence that the visitor is human. ≥ 0.70 counts as verified. Stored with reasons for every request.
Risk levelBucketed score — low, medium or high — returned by verify-token so you can enforce your own policy.

Where to go next