Glossary
What is a CAPTCHA token?
Definition
A CAPTCHA token is a short-lived string the CAPTCHA service gives the page after a pass. The page sends it with the form, and your server checks it with the provider.
How it works
- The widget places the token in a hidden form field.
- The form submits it to your server.
- Your server verifies it once. After that it is spent.
Where it matters
- Token lifetimes differ. Google documents two minutes for reCAPTCHA tokens and Cloudflare documents 300 seconds for Turnstile.
- An expired or reused token fails, so verify as soon as the form arrives.
In CaptchaKit
A CaptchaKit token is a signed JWT valid for 10 minutes and accepted once. The widget adds it to the form as gamecaptcha_token.
Questions
How long does a token last?
It depends on the provider. CaptchaKit tokens last 10 minutes and work once.
Why does a token say already used?
A token can be verified only once. Verifying again fails.
Is the token proof of a human?
It proves the check was passed. It does not prove who passed it.
Source
- Google reCAPTCHA: verifying the user's response (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.