React quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Not published yet

@revokegpt/react is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

npm install @revokegpt/react @revokegpt/js     # after the first release

Peer dependency: React 18.2 or 19. The entry carries "use client", so it works in the Next.js App Router, and it touches no window during a server render. For a visible widget use the <RevokeGPT sitekey="rgpk_..." onVerify={...} /> component instead of the hook.

Signup.tsx

import { useRevokeGPT } from '@revokegpt/react';

export function Signup() {
  const { execute, ready } = useRevokeGPT({ sitekey: 'rgpk_...', action: 'signup' });

  async function onSubmit(event: { preventDefault(): void }) {
    event.preventDefault();
    const token = await execute(); // send it to your server with the form
    await fetch('/signup', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ token }),
    });
  }

  return (
    <form onSubmit={onSubmit}>
      <button type="submit" disabled={!ready}>
        Sign up
      </button>
    </form>
  );
}

3. Verify the token on your server

The token proves nothing until your server verifies it with your secret key. Pick your server SDK: Node, Python, PHP, Go, Java or WordPress. Without an SDK, call siteverify directly:

curl -s https://api.revokegpt.com/v1/siteverify \
  -d secret="$REVOKEGPT_SECRET" -d response="$TOKEN"

The secret key (rgsk_...) goes only on your server. Never put it in a page or an app.

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).