JavaScript quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

npm install @revokegpt/js     # after the first release

The wrapper loads the widget script from https://js.revokegpt.com/v1/api.js once, renders a widget (invisible by default) and gives you a token with execute(). It has no runtime dependencies. If your page has a Content Security Policy, pass a nonce to load() and allow the widget origin in script-src and frame-src.

import { load, render } from '@revokegpt/js';

// Load the widget script once (it is served from https://js.revokegpt.com).
await load();

const widget = render(document.getElementById('captcha') as HTMLElement, {
  sitekey: 'rgpk_...', // your site key (public)
  action: 'signup', // the action your server expects
});

// Call this when the form is submitted, then send the token to your server.
export async function onSubmit(form: HTMLFormElement): Promise<void> {
  const token = await widget.execute();
  await fetch('/signup', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email: new FormData(form).get('email'), token }),
  });
  widget.reset(); // a token is single use
}

3. Verify the token on your server

The token proves nothing until your server verifies it with your secret key. Pick your server SDK: Node, Python, PHP, Go, Java or WordPress. Without an SDK, call siteverify directly:

curl -s https://api.revokegpt.com/v1/siteverify \
  -d secret="$REVOKEGPT_SECRET" -d response="$TOKEN"

The secret key (rgsk_...) goes only on your server. Never put it in a page or an app.

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

The secret key is in your server’s secret store, not in source control, a page or an app.
The server checks success, the expected action, the expected hostname (or app) and a minScore.
A refused or failed verification blocks the action. Treat every failure as “do not accept”.
The token is sent over HTTPS and used once; a retry needs a new token.
Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).