How long does switching from reCAPTCHA or hCaptcha take?

Usually an afternoon. Our verification endpoint answers in both the reCAPTCHA and the hCaptcha response shapes, so the code already running on your backend keeps working - you change the script tag and the sitekey. Server SDKs are available for Go, Node, PHP and Python.

Ticket bot and scalper prevention for on-sale rushes

Bots are aimed at the seat-hold endpoint before the on-sale opens, then fire hundreds of holds in seconds.

Get started free See the integration

How ticket bots beat the queue

Real browsers under automation through a residential proxy pool, sessions warmed on the event page minutes ahead. At the on-sale second every session POSTs the seat-hold endpoint in parallel.

What ticket scalping looks like in your logs

Holds in the first ten seconds outnumber the on-sale's completed payments.

Seat-hold POSTs from sessions that never fetched the event page.

Same seats held, released at expiry, re-held across rotating accounts.

How PrivCaptcha stops ticket scalping

Four steps, with the numbers the server uses. Nothing here is configured by you.

No token without the allowlisted page

List your domains. A runner aimed at the seat-hold endpoint is refused with invalid-input-origin and never gets a privcaptcha-response.

What a scalper actually scores

Everyone starts at 20: level 2, 16 degrees, 10 pixels, 14 proof-of-work bits. Automation user-agent without Accept-Language scores 20+40+15=75: level 4, 6 pixels.

Wrong answers compound in the drop

Each failure adds 8 to that address's daily score, max +40. Three failures: 44, level 3, 13 degrees, 8 pixels.

Nothing can be prepared in advance

Challenge and token live 120 seconds. A stockpile built before the on-sale has expired. Holding a token at 10:00:00 means finishing after 09:58.

What a ticket scalping run costs now: The play was 500 concurrent claims. Each now costs a challenge plus proof-of-work: 16,000 hashes at 14 bits. Cost is per claim, not per session. 10 requests per second per IP on /api/v1/challenge makes the proxy pool the ceiling.

Add PrivCaptcha to your cart or seat-claim step in two lines of code

Script tag, container in front of the submit button, and your existing verify call. Already on reCAPTCHA or hCaptcha? That backend code stays exactly as it is.

Quickstart guide Widget installation Verify a token

reCAPTCHA siteverify hCaptcha siteverify

Server SDKs

Go Node PHP Python

POST https://privcaptcha.com/api/v1/siteverify

Where it goes

On the seat-select or add-to-cart POST that claims inventory. Not login or queue entry.

What the backend does

Post privcaptcha-response to /api/v1/siteverify server-to-server. Write the hold only when success is true.

The usual mistake

Verifying once, then flagging the session human for checkout. Warmed pools exist for that. Mint one token per claim.

What this does not solve about ticket scalping

It prices attempts, not fairness. Hand solvers still beat a buyer typing a card number. Address rotation starts clean.

Other use cases

Bot protection Credential stuffing Account takeover Fake signups Spam comments Card testing Scraping Giveaway abuse Click fraud

Common questions about ticket scalping

How PrivCaptcha prices ticket scalping, and what it does not do about it.

At the step where inventory is actually claimed - the cart or seat selection - rather than at login. That is the moment worth defending when everything opens at once.

No. There is no country-level gating and no Google dependency, so buyers on privacy browsers and unusual networks are treated like everyone else.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

No. An address is used for the length of one request and never written anywhere. What we keep is an HMAC of it under a salt that is random, lives only in Redis and rotates every day, so yesterday's hashes cannot be linked to today's. The counters under that hash expire after 24 hours.

Put PrivCaptcha in front of your cart or seat-claim step

10,000 verifications a month are free, and the integration is the one you already have.

Get started free Read the docs