CAPTCHA

A bot check people never see, run on our own servers

Every protected form gets an invisible proof-of-work challenge. The browser spends a moment on arithmetic; bots pay for every attempt. No puzzle, no tracking script, and in first-party mode no visitor data leaves the platform.

Book a demo How the challenge works

Challenge · portal_loginLive

ProviderFirst-party

Difficulty16 leading zero bits

Bound tosurface, app and host

Expires300 seconds

Useonce

Solved ina Web Worker

Mode on this surface: enforce. Other surfaces can observe first.

Why it matters

Keep bots out without a puzzle or a tracker

Nothing to solve, nothing to track

People see no puzzle. In first-party mode no third party receives the visitor's address or browser.

Watch first, then enforce

Each surface runs off, observe or enforce, so you see the effect before anyone is refused.

Outages never lock people out

If a vendor's check times out, the request is admitted and counted, not refused.

How it works

One challenge, start to finish

1Hosted pageAsk for a challengeFor one surface and one application.
2Identity StudioSign the challengeHMAC-SHA256 over salt, difficulty, expiry, surface, app and host. Nothing is stored yet.
3BrowserFind the nonceA Web Worker searches until SHA-256(salt + nonce) has enough leading zero bits.
4BrowserSubmit the formWith the token, or the reason there is none.
5Identity StudioVerify and spendSignature, binding, proof and expiry checked; the salt is spent so a replay fails.

Capabilities

What you control

Capability	How it works	Status
Modes per surface	off, observe or enforce for sign-in, sign-up and password reset on the console and on your hosted pages, plus magic link, approval and resend-verification doors.	Live
Provider per application	First-party, Cloudflare Turnstile, hCaptcha or Google reCAPTCHA, with the application's own keys. The secret is encrypted and never returned.	Live
Adaptive difficulty	Each pressure signal adds 2 bits up to a ceiling: more than 20 challenges a minute, or more than 5 refused checks in 10 minutes, from one address digest.	Live
Host binding	The host comes from the request's Origin, never from the caller. A token solved on one origin fails on another.	Live
Analytics	Per surface and per app: passes, failures by reason (expired, binding, signature, proof, replay), missing tokens, fail-open counts. Daily, kept 35 days.	Live
Fail-open	A vendor timeout (5 seconds) or an unreadable secret admits the request and counts error_failopen.	Live

Puzzle-free by default — a visible puzzle when you want one. Choose a slider puzzle for any hosted page in Applications → your app → CAPTCHA. To protect your own website, create a site key in the console under Security → CAPTCHA, add the widget to your form, and confirm each answer from your server with siteverify. The same check still guards the console and your apps' hosted pages.

Configuration

Settings

Set for the deployment, then tightened per application. An application can make its own surfaces stricter, never looser.

Option	Values	Default
provider	first_party, turnstile, hcaptcha, recaptcha	first_party
surface_modes	off, observe or enforce, per surface	observe
difficulty_mode	fixed or adaptive	fixed
difficulty_bits · ceiling	8 to 24 leading zero bits	16 · 16
challenge_ttl_seconds	60 to 900	300

Under the hood

What protects it

From the code

services/captcha_first_party.pythe proof and its signature

def _signed(salt, difficulty, expires, surface,
            application, host) -> str:
    message = f"{salt}|{difficulty}|{expires}|{surface}|{application}|{host}".encode()
    return hmac.new(_key(), message,
                    hashlib.sha256).hexdigest()

def solves(salt, nonce, difficulty) -> bool:
    return leading_zero_bits(hashlib.sha256(
        f"{salt}{nonce}".encode()).digest()) >= int(difficulty)

Security notes

Single use: a spent salt is recorded, and a replay fails with reason replay.
Adaptive pressure is keyed by a digest of the address; no fingerprint is stored.
With a vendor provider, the vendor receives the visitor's address; first-party mode sends nothing out.
Changes to the settings need a fresh step-up and are audited.

Works with

Part of one platform

Conditional access & risk The next layer after the bot check.Hosted sign-in The pages it protects.Audit & SIEM export Settings changes on the record.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Stop bots without bothering people

Turn on the first-party check in observe mode and watch the numbers before you enforce.

Book a demo Start free trial