FAQ
How long is a token valid?
A token is short-lived and single-use. Verify it once, immediately after the form is
submitted. If verification fails with token_expired, have the visitor solve again.
What's the difference between the site key and the secret key?
The site key (public) goes in the widget markup in your page's HTML. The secret
key stays on your server and is only sent in the /v1/verify call. Never expose the
secret key to the browser.
Do I need JavaScript on my server?
No. The widget injects a hidden nc-response field, so a plain HTML form submit works.
Your server just needs to make one HTTP POST to verify the token.
Where do I get my keys?
From your site in the dashboard.