Glossary
Site key vs secret key: what is the difference?
Definition
A site key is a public identifier you put in your page so the widget can load. A secret key is a private credential your server uses to check tokens, and it must never appear in client-side code.
How it works
- The page loads the widget with the site key.
- After the visitor passes, the widget gives the page a token.
- Your server calls the provider with the secret key and the token to learn whether it is valid.
Where it matters
- Leaking the secret key lets someone else verify, or fake the checks for, your site. Keep it in an environment variable.
- Rotate it if you suspect exposure.
In CaptchaKit
CaptchaKit's public value is the site key, which starts with gc_. The private value is your API key, sent as a Bearer token on POST /api/verify.
Questions
Is the site key secret?
No. It is public and appears in your HTML.
Where do I store the secret key?
On the server, in an environment variable or secrets manager, never in front-end code.
What if the secret key leaks?
Rotate it. In CaptchaKit, rotating the API key stops the old key from working immediately.
Source
- Cloudflare Turnstile: get started (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.