Introduction

Myra EU CAPTCHA protects websites and APIs against misuse such as form spam and credential stuffing. The service is operated by Myra Security GmbH and hosted in Europe. The verification runs invisibly in the background; visitors solve no puzzle.

Overview of Myra EU CAPTCHA and the web interface

Characteristics

The service differs from classic CAPTCHA methods in the following points:

Characteristic	Description
Form and login protection	The service protects forms and login pages against spam and credential stuffing.
Bot protection	A fingerprint detection recognises requests from bots and blocks them.
Verification without user input	Users solve no puzzle and tick no checkbox. The verification runs automatically in the background, through cryptographic computations.
Intelligent risk detection	The risk analysis adjusts the difficulty of the challenges dynamically as soon as a behaviour becomes suspicious.
Signal-based	The detection is trained daily with more than 100 billion CDN signals.
No cookies and no data storage	The service works without HTTP cookies and without persistent browser storage. No cookie banner is required for it.
European operation	The service is operated in Europe and designed for the GDPR.
Self-service setup	The integration requires no DNS change and is completed in three steps.
Cross-platform integration	Libraries and scripts are available for CMS platforms, frontend frameworks, backend languages, mobile apps and infrastructure tools.
API support	A REST API is available for the programmatic connection.
Dedicated dashboard	A web interface shows the statistics and manages the sitekeys.
Sitekey creation	A new sitekey is created by entering the domain to be protected.
Sitekey configuration	The protection can be activated or deactivated per sitekey. Difficulty, delay and parallel challenges are configurable.
Widget customisation	A dark mode is available for the widget.
Access management	Team members receive read or write access to a sitekey.

Limitations

EU CAPTCHA is at an early stage of development. Note the following limitations:

Limitation	Description
No integration with other Myra products	A connection to other products of Myra Security is currently not available.
No migration	A migration option from an existing CAPTCHA solution is currently not available.
JavaScript required	The verification is based on JavaScript and a client-side proof of work. Without activated JavaScript, it does not work.
Computing time on weak devices	On low-performance devices, the proof of work takes up a noticeable amount of computing time.
No absolute protection	Even a signal-based bot detection does not completely rule out highly developed bots with real browser environments.

Note

Understand the risk assessment as one layer of protection, not as the only security measure.

Sitekey and secret

Every protected domain gets a key pair:

Key	Format	Use
Sitekey	UUID	Public. Appears in the HTML of the page and identifies the website.
Secret	Base64	Confidential. Used on the server only, for the verification.

Warning

Never output the secret in the browser and never store it in a public repository.

Both values appear in the Public Sitekey and Secret(s) area. You reach it through the Integrations button in the row of the sitekey, Details step. See Details view.