From reCAPTCHA
PrivCaptcha answers on reCAPTCHA's own script path and exposes a grecaptcha global with the
same methods, so an existing v2 checkbox integration migrates with two URL changes.
1. The script
- <script src="https://www.google.com/recaptcha/api.js" async defer></script>
+ <script src="https://privcaptcha.com/recaptcha/api.js" async defer></script>
Your markup stays exactly as it is:
<div class="g-recaptcha" data-sitekey="pk_your_sitekey"></div>
Only the sitekey value changes — use your PrivCaptcha pk_... key. The
g-recaptcha-response form field keeps its name, so your form and your request handler are
untouched.
/1/recaptcha.js serves the same bundle if you prefer an explicit URL.
2. The verify call
- https://www.google.com/recaptcha/api/siteverify
+ https://privcaptcha.com/recaptcha/api/siteverify
Point your existing call at that path with your PrivCaptcha secret. It returns the same
{success, challenge_ts, hostname, error-codes} shape, so most libraries need no change
beyond the URL. If you would rather use the native endpoint and a first-party helper, see
Verify a token and the SDKs.
What the shim supports
grecaptcha method |
Behaviour |
|---|---|
render(container, params) |
renders a widget; the response field stays g-recaptcha-response |
execute(id) |
opens the challenge programmatically |
reset(id) |
clears the token |
getResponse(id) |
returns the current token |
ready(cb) |
honoured — callbacks queued before load run once the widget boots |
Elements with class="g-recaptcha" are picked up automatically on page load.
Differences to expect
- No score. reCAPTCHA v3's risk score has no equivalent here, because PrivCaptcha does not
profile visitors. The hCaptcha-shaped alias reports
score: 0.0as a constant; do not branch on it. If your integration gates on a v3 score threshold, replace it with a plain pass/fail onsuccess. - Tokens expire in 120 seconds and verify exactly once.
- Domains are enforced by us. Add your hostnames under Sites and domains once the integration works.
- No cookies. Nothing is set on your visitor's device, so there is nothing to disclose in a cookie banner for the captcha.