“How do I verify a CaptchaKit token in Node.js?”

How do I verify a CaptchaKit token in Node.js?

By the CaptchaKit team

Short answer

POST the token to https://captchakit.com/api/verify with fetch, built into Node since version 18. Send your secret key in an Authorization: Bearer header and the token plus your site key as the JSON body. Read success from the response and return a 400 before creating anything when it is false. The sample below mirrors the CaptchaKit docs, with both keys read from environment variables.

1Set twoenvironment…2Post the tokenfor verification3Reject onfailure

Steps

  1. 1

    Set two environment variables

    CAPTCHAKIT_SECRET_KEY for the API key and CAPTCHAKIT_SITE_KEY for the site key. fetch needs no install on Node 18 or newer.

  2. 2

    Post the token for verification

    Call fetch with method POST, the Bearer header and a JSON.stringify body of token and siteKey, exactly as the docs define.

  3. 3

    Reject on failure

    If success is false, return a 400 response and stop before the account is created or the email is sent.

The code

An Express handler; the same fetch call works in a Next.js Route Handler, Fastify, Hono or a plain script.

import express from 'express';

const app = express();
app.use(express.json());

app.post('/api/signup', async (req, res) => {
  const { email, gamecaptchaToken } = req.body;

  const verify = await fetch('https://captchakit.com/api/verify', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${process.env.CAPTCHAKIT_SECRET_KEY}`,
    },
    body: JSON.stringify({
      token: gamecaptchaToken,
      siteKey: process.env.CAPTCHAKIT_SITE_KEY,
    }),
  });

  const { success, gameId } = await verify.json();

  if (!success) {
    return res.status(400).json({ error: 'Bot detected. Please try again.' });
  }

  // token is valid, create the account
  await createUser(email);
  res.json({ ok: true });
});

Token rules to know

A pass returns success true with the game's identifier, such as { "success": true, "gameId": "connect4" }. Failures return success false. Tokens expire after 10 minutes and can be verified once, so a replayed token fails too. See how to verify a CAPTCHA token for the flow end to end, and the docs for the same call in Python and PHP.

Questions

What is the verify endpoint?

POST https://captchakit.com/api/verify.

What goes in the request body?

A JSON object with token and siteKey. Nothing else.

Which key goes in the header?

Your secret API key, as Authorization: Bearer. The site key belongs in the body, not the header.

What does a successful verify return?

{ "success": true, "gameId": "connect4" } for a valid token, with the game that was played.

Why did my call return success false?

The token was already used once, expired after 10 minutes, or the keys do not match.

Does this work without Express?

Yes. fetch is global in Node 18 and newer, so any handler, script or serverless function can make the same call.

Can I call the endpoint from the browser?

No. The secret key must stay on your server, in an environment variable.

Sources

  1. CaptchaKit documentation (checked 2026-10-18)
  2. Node.js fetch API reference (checked 2026-10-18)

Related

Protect your forms with a game

Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.

Get started →Pay what you want. Start free.