Glossary
What is siteverify? Server-side token verification
Definition
Siteverify is the name Cloudflare and Google use for the server-side endpoint that validates a CAPTCHA token. Your backend sends the token and secret key, and the provider replies with success or failure.
How it works
- The browser posts a form that includes the token.
- Your server forwards the token and secret to the provider.
- The provider answers, and your server accepts or rejects the form.
Where it matters
- Without this call, the token is just a string. A bot can send any string.
- Tokens are short lived and single use, so verify once, immediately.
In CaptchaKit
CaptchaKit's equivalent is POST /api/verify with an Authorization Bearer API key and a body of token and siteKey. It returns success and gameId, or success false and an error.
Questions
Can I verify in the browser?
No. Verification needs the secret key, which must stay on the server.
What happens if I skip verification?
The CAPTCHA does nothing, since any value in the token field would be accepted.
Why does verification fail on a second try?
Tokens are single use. A second check of the same token fails.
Source
- Cloudflare Turnstile: validate the token (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.