Backend Implementation

The following explains how to retrieve the verification result on the server side and determine the next steps based on it.

You can use Trustcaptcha with any programming language and framework of your choice and customize it entirely to your needs. Below you will find detailed documentation of the backend process and the corresponding API interface.

To make using Trustcaptcha as easy as possible, libraries are provided for commonly used programming languages and frameworks. These simplify a large part of the subsequent process. However, we still recommend reading this tutorial first. This will give you a good understanding of the underlying process.

Below you will find a current list of libraries provided:

When a captcha is successfully solved, the Trustcaptcha component returns a verification token. This must be transmitted to the backend and can be further processed there. Below, the structure of the verification token is explained.

The verification token returned by the Trustcaptcha component is encoded in Base64.

When you decode the verification token, you get back a JSON object. This contains the verification ID and the encrypted access token named encryptedAccessToken.

The access token named encryptedAccessToken in the verification result is encrypted with AES. This ensures that only you are able to retrieve the verification result. First, the encryptedAccessToken needs to be decoded from base64 and converted into a binary format. Then decrypt it using your secret-keyue. Use AES-265 in CBC mode. Use a PKCS5Padding and a 16-byte initialization vector (IV).

Below you will find some implementation examples for AES decryption.

Below you will be explained how to retrieve the verification result, what information it contains, and how you can work with it.

You can retrieve the verification result from our servers using the following URL.

The returned verification result looks like this:

The Bot Score returns a decimal value between 0 and 1. It provides information on the likelihood that the requesting client is a bot. The lower the value, the more likely the user is human. The higher the value, the more likely it is a machine user.

The Bot Score allows you to define a simple threshold at which you either allow or deny the request. Our recommendation is to set the threshold at 0.5. However, based on the Bot Score, you can also establish different security measures for various probabilities, such as additional two-factor authentication or email confirmation.

The reason provides insight into why the bot score and the statement about VerificationPassed were made accordingly.

Errors can occur when retrieving the verification result. Below you will find an overview of all status codes along with a description of what went wrong and what you should consider.