FAQ & Troubleshooting

Open the browser console/network tab. Usually the cause is (1) the wrong site key, (2) the site is deactivated in the dashboard, or (3) the API origin can't be reached. The widget falls back to a demo token only on network errors — check that your instance is up and HTTPS is valid.

Tokens expire after 2 minutes and are bound to the site that issued them. Make sure you verify immediately when the form arrives, that the token field name is ai-captcha-response, and that you're using the secret key belonging to the same site as the site key in the widget.

That's the engine working correctly. Requests without behavioral data are capped at 0.65, and HTTP-library user agents are hard-capped at 0.05. Test through a real browser, or send mouse_entropy / interaction_speed samples in the request body.

Yes. Register localhost or 127.0.0.1:port as a site domain. The scoring engine gives a small bonus when the request origin matches the registered domain — on localhost simply register the exact host:port you develop on.

Rate limits: 30 generate-token requests/minute per IP and 60/minute per site key. A debug loop can hit this quickly. If you need more, run your own instance and tune the constants in src/lib/rate-limit.ts or front it with nginx limit_req.

You can, but you lose the origin-consistency bonus and the adaptive baseline gets mixed traffic. Best practice: register one site per domain.

No. The widget only records the number of milliseconds between keystrokes, never what was typed. Mouse samples are coordinate deltas. See the Privacy Policy.

The field is named ai-captcha-response — if you already use that name, rename yours. Any other integration (fetching the value via JS or the aicaptcha:verified event) is documented in Client-side Widget.