hCaptcha Siteverify API

Name: hCaptcha Siteverify API
Brand: hCaptcha Siteverify API
Availability: InStock

✓ Official Vendor SpecSecurityThreat DetectionapiKey1 EndpointsREST

For Agents

Verify an hCaptcha challenge response token server-side to confirm the request came from a human and not a bot.

Install Jentic One Beta

Connect the hCaptcha Siteverify API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the hCaptcha Siteverify API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with hCaptcha Siteverify API.

Verify an hCaptcha challenge response token through POST /siteverify

Confirm the verifying domain matches the hostname registered for the sitekey

Detect token reuse, expired tokens, and missing-input errors from the response payload

GET STARTED

Start building with hCaptcha Siteverify API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use hCaptcha Siteverify API for, with concrete tasks.

★ Signup Form Bot Protection

Embed the hCaptcha widget on the signup page and post the resulting token to /siteverify before creating the user record. The endpoint returns success only if the token is unused, unexpired, and tied to the registered sitekey, so fake account scripts that scrape the page without solving the challenge fail at the verification step. This stops the most common signup spam without adding friction for real users.

POST to /siteverify with secret, response, and remoteip fields and reject the signup when success is false

Comment Form Anti-Spam

Wire /siteverify into the comment-submission handler so each posted comment carries a fresh, unused hCaptcha token. The verification check sits server-side, so attackers cannot bypass it by stripping the widget. Combine with the optional remoteip field to catch token-replay attempts coming from different IP addresses.

POST to /siteverify and reject the comment if the response error-codes array contains timeout-or-duplicate

Trigger an hCaptcha challenge after a small number of failed login attempts and require a successful /siteverify response before processing the next attempt. The verification step ensures the next try comes from a real browser solving a real challenge, slowing automated credential-stuffing tools to a crawl. Pair this with rate limiting for layered defense.

POST to /siteverify after a third failed login and only process the next password attempt if success is true

AI Agent Captcha Gate via Jentic

Agents that automate signups or form submissions on partner sites call the hCaptcha verify operation through Jentic to confirm a token before forwarding it on. Jentic stores the site secret in the vault, so multiple agents can share the operation without each holding the raw key. This makes it practical to build captcha-aware automation toolkits.

Use Jentic search 'verify a captcha token' to load /siteverify and execute with the secret pulled from the vault

Key Endpoints

1 endpoints — the hcaptcha siteverify api verifies the response token returned when a user solves an hcaptcha challenge on a webpage or mobile screen.

METHOD

PATH

DESCRIPTION

POST

/siteverify

Verify an hCaptcha response token

POST

/siteverify

Verify an hCaptcha response token

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The hCaptcha site secret is the only credential and grants full verification rights for the sitekey. Jentic stores it in the vault (MAXsystem) and injects it into the secret query parameter at execution time.

Intent-based discovery

Agents search Jentic for 'verify a captcha token' or 'check hcaptcha response' and Jentic returns the /siteverify operation with its parameters.

Time to first call

Direct hCaptcha integration: 1-2 hours to wire form embedding and server-side verify. Through Jentic: under 10 minutes for the verify call — search, load, execute.

FAQs

Specific to using hCaptcha Siteverify API through Jentic.

What authentication does the hCaptcha Siteverify API use?

Authentication is through the secret query parameter, which carries your hCaptcha site secret. Jentic vaults the secret and adds it to each /siteverify call, so agents never hold the raw key.

Can I verify an hCaptcha token without sending the user IP?

Yes. The remoteip field on POST /siteverify is optional. Sending it adds a check that the verifying IP matches the IP that solved the challenge, which is a useful extra signal but not required.

What are the rate limits for the hCaptcha Siteverify API?

hCaptcha does not enforce a public per-account rate limit on /siteverify; the endpoint scales with your traffic. Excessive verifications against unrelated tokens can still trigger account-level review.

How do I verify a captcha token through Jentic?

Search Jentic for 'verify a captcha token', load the /siteverify operation for hcaptcha.com, and execute with the response token from the form. Jentic supplies the site secret from the vault.

Is the hCaptcha Siteverify API free?

hCaptcha's Publisher plan is free and includes server-side /siteverify calls. Enterprise plans add risk scoring and account defender features but use the same endpoint.

Why does my /siteverify call return timeout-or-duplicate?

That error code means the token has already been verified or was generated more than two minutes before the call. Generate a fresh token from the widget and post it once — tokens are single-use.