“How do I verify a CaptchaKit token in Python?”
How do I verify a CaptchaKit token in Python?
Short answer
POST the token to https://captchakit.com/api/verify with requests. Send your secret key in an Authorization: Bearer header and the token plus your site key as the JSON body. Read success from the response and return a 400 before creating anything when it is false. The sample below mirrors the CaptchaKit docs, with both keys read from environment variables.
Steps
- 1
Set two environment variables
CAPTCHAKIT_SECRET_KEY for the API key and CAPTCHAKIT_SITE_KEY for the site key. Install requests with pip.
- 2
Post the token for verification
Call requests.post with the Bearer header and a JSON body of token and siteKey, exactly as the docs define. No other parameters exist.
- 3
Reject on failure
If success is false, return a 400 response and stop before the account is created or the email is sent.
The code
A Django-style view; the same call works in Flask, FastAPI or a plain script.
import os
import requests
from django.http import JsonResponse
def signup(request):
email = request.POST.get('email')
token = request.POST.get('gamecaptchaToken')
verify = requests.post(
'https://captchakit.com/api/verify',
headers={
'Authorization': 'Bearer ' + os.environ['CAPTCHAKIT_SECRET_KEY'],
'Content-Type': 'application/json',
},
json={
'token': token,
'siteKey': os.environ['CAPTCHAKIT_SITE_KEY'],
},
)
data = verify.json()
if not data.get('success'):
return JsonResponse({'error': 'Bot detected'}, status=400)
# token is valid, create the account
create_user(email)
return JsonResponse({'ok': True})Token rules to know
A pass returns success true with the game's identifier, such as { "success": true, "gameId": "connect4" }. Failures return success false. Tokens expire after 10 minutes and can be verified once, so a replayed token fails too. See how to verify a CAPTCHA token for the flow end to end, and the docs for the same call in Node and PHP.
Questions
What is the verify endpoint?
POST https://captchakit.com/api/verify.
What goes in the request body?
A JSON object with token and siteKey. Nothing else.
Which key goes in the header?
Your secret API key, as Authorization: Bearer. The site key belongs in the body, not the header.
What does a successful verify return?
{ "success": true, "gameId": "connect4" } for a valid token, with the game that was played.
Why did my call return success false?
The token was already used once, expired after 10 minutes, or the keys do not match.
Can I call the endpoint from the browser?
No. The secret key must stay on your server, in an environment variable.
Is there an async version?
Swap requests for httpx and await httpx.post with the same arguments.
Sources
- CaptchaKit documentation (checked 2026-10-18)
- requests documentation (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.