captcha

README

InfoPeak Captcha for Go

Server-side verification for InfoPeak Captcha - the privacy-first, EU-hosted captcha. No tracking, no cookies, no image puzzles.

Install

go get github.com/infopeak/captcha-go

Requires Go 1.20+. Zero dependencies (standard library only).

Usage

Add the widget to your form (full guide):

<form action="/signup" method="POST">
  <input type="email" name="email" required>
  <div class="infopeak-captcha" data-sitekey="YOUR_SITEKEY"></div>
  <button type="submit">Sign up</button>
</form>
<script src="https://captcha.infopeak.io/infopeak-captcha.js" defer></script>

Verify the token when the form is submitted:

import captcha "github.com/infopeak/captcha-go"

var client = captcha.New("YOUR_SITEKEY", os.Getenv("INFOPEAK_CAPTCHA_SECRET"))

func signup(w http.ResponseWriter, r *http.Request) {
    if !client.Verify(r.FormValue(captcha.Field)) {
        http.Error(w, "Captcha verification failed", http.StatusBadRequest)
        return
    }
    // ... proceed
}

Need quota information too?

result := client.VerifyDetailed(token)
result.Valid     // true when the token was genuine and unused
result.OverLimit // true when the sitekey is over its monthly quota

Verification fails closed: network errors and non-200 responses return Valid: false.

Testing

Public test credentials that work on any domain and never count against a quota (never use in production):

sitekey: ipk_test_sitekey
secret:  ipk_test_secret

Links

• Get a free sitekey - 10,000 verifications/month at no cost
• Developer documentation

License

MIT

Documentation

Overview

Package captcha provides server-side verification for InfoPeak Captcha, the privacy-first, EU-hosted captcha.

See https://infopeak.io/captcha/developers

Index

• Constants
• type Client
  • func New(sitekey, secret string) *Client
  • func (c *Client) Verify(token string) bool
  • func (c *Client) VerifyDetailed(token string) Result
• type Result

Constants

const Field = "infopeak-captcha-response"

Field is the name of the hidden form field the widget injects.

Types

type Client

type Client struct {
	Sitekey string
	Secret  string
	// APIOrigin overrides the API origin. Defaults to https://captcha.infopeak.io
	APIOrigin string
	// HTTPClient overrides the HTTP client. Defaults to a client with an 8s timeout.
	HTTPClient *http.Client
}

Client verifies InfoPeak Captcha tokens.

func New

func New(sitekey, secret string) *Client

New returns a Client for the given sitekey and secret.

func (*Client) Verify

func (c *Client) Verify(token string) bool

Verify reports whether the token was genuine and had not been used before. It fails closed: network errors and non-200 responses return false.

func (*Client) VerifyDetailed

func (c *Client) VerifyDetailed(token string) Result

VerifyDetailed verifies a token and returns the full result, including whether the sitekey is over its monthly quota.

type Result

type Result struct {
	// Valid is true when the token was genuine and unused.
	Valid bool
	// OverLimit is true when the sitekey is over its monthly quota
	// (verification still succeeds).
	OverLimit bool
}

Result of a siteverify call.