Vue quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Not published yet

@revokegpt/vue is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

npm install @revokegpt/vue @revokegpt/js     # after the first release

Peer dependency: Vue 3.4 or later. Call the composable in setup(). For a visible widget use the component:

<RevokeGPT v-model="token" sitekey="rgpk_..." size="normal" />

In Nuxt, wrap the component in <ClientOnly>: the widget only exists in the browser.

signup.ts

import { useRevokeGPT } from '@revokegpt/vue';

// In setup() of your component (the template is shown on the page).
export function useSignup() {
  const { execute, ready } = useRevokeGPT({ sitekey: 'rgpk_...', action: 'signup' });

  async function submit(): Promise<void> {
    const token = await execute(); // send it to your server with the form
    await fetch('/signup', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ token }),
    });
  }

  return { submit, ready };
}

3. Verify the token on your server

The token proves nothing until your server verifies it with your secret key. Pick your server SDK: Node, Python, PHP, Go, Java or WordPress. Without an SDK, call siteverify directly:

curl -s https://api.revokegpt.com/v1/siteverify \
  -d secret="$REVOKEGPT_SECRET" -d response="$TOKEN"

The secret key (rgsk_...) goes only on your server. Never put it in a page or an app.

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).