Go quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Add a client first: JavaScript, React or Vue.

3. Verify the token on your server

Not published yet

The github.com/revokegpt/revokegpt-go module is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

go mod edit -require github.com/revokegpt/revokegpt-go@v0.0.0
go mod edit -replace github.com/revokegpt/revokegpt-go=/path/to/checkout/sdks/go   # until the first release
go get github.com/revokegpt/revokegpt-go                                            # after the first release

The core module uses the standard library only. Verify never returns an error and never panics: gate on out.OK. MinScore and ExpectedAction are pointers. Behind a proxy take RemoteIP from the header your own proxy appended, not r.RemoteAddr; an address with a zone id is invalid, so leave RemoteIP empty then.

verify.go

package signup

import (
  "context"
  "log"
  "os"

  revokegpt "github.com/revokegpt/revokegpt-go"
)

// Create the client once. The secret (rgsk_...) never appears in fmt, slog, JSON or an error.
var client, clientErr = revokegpt.New(os.Getenv("REVOKEGPT_SECRET"), "https://api.revokegpt.com/v1/siteverify")

// AllowSignup reports whether the token is acceptable for a signup.
func AllowSignup(ctx context.Context, token, clientIP string) bool {
  if clientErr != nil {
    return false // a start-up mistake: log it once where you build the client
  }
  action, min := "signup", 0.5
  out := client.Verify(ctx, token, revokegpt.VerifyOptions{
    ExpectedHostname: "shop.example", // the hostname your page is served from, lowercase
    ExpectedAction:   &action,        // the action your page passed to the widget
    MinScore:         &min,           // required: a start, tune it later
    RemoteIP:         clientIP,       // the end user's address from your trusted proxy
  })
  if !out.OK {
    log.Printf("revokegpt refused: %v %v", out.Reason, out.Result.ErrorCodes)
    return false
  }
  log.Printf("revokegpt score: %v reasons: %v", out.Result.Score, out.Result.Reasons)
  return true
}

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).