From hCaptcha
PrivCaptcha ships an hCaptcha-shaped shim: the same hcaptcha global, the same markup, the
same form field.
1. The script
- <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+ <script src="https://privcaptcha.com/1/hcaptcha.js" async defer></script>
Your markup stays as it is, with your PrivCaptcha sitekey:
<div class="h-captcha" data-sitekey="pk_your_sitekey"></div>
The h-captcha-response field keeps its name, so your backend keeps reading the same POST
key.
2. The verify call
- https://api.hcaptcha.com/siteverify
+ https://privcaptcha.com/siteverify
That alias returns the hCaptcha response shape — success, challenge_ts, hostname,
error-codes, plus credit: false and score: 0.0 — because drop-in libraries assert on
those keys. Only the secret and the URL change.
score is a constant, not a measurement: PrivCaptcha does not profile visitors, so there is
nothing to score. Do not branch on it.
To use the native endpoint and response instead, see Verify a token and the SDKs.
What the shim supports
hcaptcha method |
Behaviour |
|---|---|
render(container, params) |
renders a widget; the response field stays h-captcha-response |
execute(id) |
opens the challenge programmatically |
reset(id) |
clears the token |
getResponse(id) |
returns the current token |
getRespKey() |
returns h-captcha-response |
Elements with class="h-captcha" are picked up automatically on page load.
Differences to expect
- Tokens live 120 seconds — the same as hCaptcha — and verify exactly once.
- Domains are enforced from the dashboard. Add your hostnames under Sites and domains.
- No cookies, no fingerprinting, no
creditprogramme.creditis alwaysfalse.