Verify the sitekey and the secret

Attention

Call the endpoint only from your server. The secret stays on the server and is not permitted in the source code of the page.

Send a POST request to the /verify-credentials endpoint at https://api.eu-captcha.eu/v1.

Description

The endpoint examines if a pair of a sitekey and a secret is valid. A token of the visitor is not necessary for this. Use the call at the start of your application or during the setup, to detect incorrect credentials early.

Different from /verify, the endpoint does not use a token and does not do a proof-of-work verification. It finds only if the sitekey is known and if the secret agrees with it. The endpoint does not examine if the sitekey is deleted or if its trial period is expired.

The endpoint is available from version 1.1 of the API.

See Verify a client token.

Request

Send the body as JSON with the Content-Type: application/json header. Without this header, the endpoint answers with valid: false. The body of the request contains these fields:

Field	Type	Necessary	Description
`sitekey`	`string`	yes	Public sitekey of the domain that the widget is embedded in. The value is shown in the Details view of the sitekey.
`secret`	`string`	yes	Secret that belongs to the sitekey. The value is shown in the Details view of the sitekey and stays on the server.

See Details view.

Example

Body of the request:

{
  "sitekey": "1c87e240-0000-0000-0000-23ac9f99da68",
  "secret": "LqFgQA••••"
}

Responses

The endpoint supplies these status codes:

Status code	Description
`200`	Result of the verification of the credentials.
`500`	Unexpected error on the server. The response does not contain a JSON body.

Missing or incorrect fields do not cause a separate status code. The endpoint answers with the 200 status code and the valid: false value.

Response fields

The response with the 200 status code contains this field:

Field	Type	Description
`valid`	`boolean`	`true` if the sitekey is available and the secret agrees with it, if not `false`.

Examples of the response

Credentials valid:

{
  "valid": true
}

Sitekey unknown, secret does not agree, or field missing:

{
  "valid": false
}