“How do I verify a CaptchaKit token in PHP?”
How do I verify a CaptchaKit token in PHP?
Short answer
POST the token to https://captchakit.com/api/verify with PHP's cURL extension. Send your secret key in an Authorization: Bearer header and the token plus your site key as a JSON body through CURLOPT_POSTFIELDS. Read success from the decoded response and return a 400 before creating anything when it is false. The sample below mirrors the CaptchaKit docs, with both keys read from environment variables.
Steps
- 1
Set two environment variables
CAPTCHAKIT_SECRET_KEY for the API key and CAPTCHAKIT_SITE_KEY for the site key. The cURL extension must be enabled, as it is on most PHP installs.
- 2
Post the token for verification
Open the endpoint with curl_init, set the Bearer header and a JSON body of token and siteKey, and execute the request.
- 3
Reject on failure
If success is false in the decoded response, send a 400 status and exit before the account is created or the email is sent.
The code
A form handler; the same call works in Laravel, Symfony or a plain script.
<?php
$email = $_POST['email'];
$token = $_POST['gamecaptchaToken'];
$ch = curl_init('https://captchakit.com/api/verify');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'Authorization: Bearer ' . getenv('CAPTCHAKIT_SECRET_KEY'),
],
CURLOPT_POSTFIELDS => json_encode([
'token' => $token,
'siteKey' => getenv('CAPTCHAKIT_SITE_KEY'),
]),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);
if (!$response['success']) {
http_response_code(400);
echo json_encode(['error' => 'Bot detected']);
exit;
}
// token is valid, create the account
createUser($email);Token rules to know
A pass returns success true with the game's identifier, such as { "success": true, "gameId": "connect4" }. Failures return success false. Tokens expire after 10 minutes and can be verified once, so a replayed token fails too. See how to verify a CAPTCHA token for the flow end to end, and the docs for the same call in Node and Python.
Questions
What is the verify endpoint?
POST https://captchakit.com/api/verify.
What goes in the request body?
A JSON object with token and siteKey. Nothing else.
Which key goes in the header?
Your secret API key, as Authorization: Bearer. The site key belongs in the body, not the header.
What does a successful verify return?
{ "success": true, "gameId": "connect4" } for a valid token, with the game that was played.
Why did my call return success false?
The token was already used once, expired after 10 minutes, or the keys do not match.
How does the token reach PHP?
From a hidden input named gamecaptchaToken in your form, so it arrives in $_POST alongside the other fields.
Can I call the endpoint from the browser?
No. The secret key must stay on your server, in an environment variable.
Sources
- CaptchaKit documentation (checked 2026-10-18)
- PHP cURL manual (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.