# FAQ

## How long is a token valid?

A token is short-lived and single-use. Verify it once, immediately after the form is
submitted. If verification fails with `token_expired`, have the visitor solve again.

## What's the difference between the site key and the secret key?

The **site key** (public) goes in the widget markup in your page's HTML. The **secret
key** stays on your server and is only sent in the `/v1/verify` call. Never expose the
secret key to the browser.

## Do I need JavaScript on my server?

No. The widget injects a hidden `nc-response` field, so a plain HTML form submit works.
Your server just needs to make one HTTP POST to verify the token.

## Where do I get my keys?

From your [site](/sites/) in the dashboard.