PHP quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Add a client first: JavaScript, React or Vue.

3. Verify the token on your server

Not published yet

The revokegpt/revokegpt Composer package is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

composer config repositories.revokegpt path ./sdks/php   # from a checkout, until the first release
composer require "revokegpt/revokegpt:@dev"
composer require revokegpt/revokegpt                      # after the first release

Requires PHP 8.1 and ext-json; the default transport needs ext-curl, or pass any PSR-18 client. Declare strict_types=1 in the files that call the SDK. verify never throws: gate on $outcome->ok. For Laravel, bind one client in a service provider and inject it; for the Laravel firewall middleware see Laravel.

verify.php

<?php

declare(strict_types=1);

use RevokeGPT\Client;
use RevokeGPT\VerifyOptions;

// Create the client once. The secret (rgsk_...) never shows in a dump, an exception or a trace.
$client = new Client((string) getenv('REVOKEGPT_SECRET'), 'https://api.revokegpt.com/v1/siteverify');

function allowSignup(Client $client, string $token, string $clientIp): bool
{
    $outcome = $client->verify($token, new VerifyOptions(
        expectedHostname: 'shop.example', // the hostname your page is served from, lowercase
        expectedAction: 'signup',         // the action your page passed to the widget
        minScore: 0.5,                    // required: a start, tune it later
        remoteip: $clientIp,              // the end user's address from your trusted proxy
    ));
    if (!$outcome->ok) {
        error_log('revokegpt refused: ' . (string) $outcome->reason);
        return false;
    }
    error_log('revokegpt score: ' . (string) $outcome->result->score);
    return true;
}

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).