One visit,
start to finish.
Everything that happens between a page loading and your server saying yes, in nine moves. Press Show the tech for the details.
- api.js Step 1: RevokeGPT edge to Visitor’s browser, api.js
- challenge Step 2: Visitor’s browser to RevokeGPT edge, challenge
- solve Step 3: Visitor’s browser to Visitor’s browser, solve
- solution + signals Step 4: Visitor’s browser to RevokeGPT edge, solution + signals
- pass Step 5: RevokeGPT edge to Visitor’s browser, pass
- form + pass Step 6: Visitor’s browser to Your server, form + pass
- siteverify Step 7: Your server to RevokeGPT edge, siteverify
- score + reasons Step 8: RevokeGPT edge to Your server, score + reasons
- decide Step 9: Your server to Your server, decide
The widget loads
Your page loads a small script from js.revokegpt.com, served from the Cloudflare location closest to the visitor.
GET js.revokegpt.com/v1/api.js · loader capped at 30 KB gzipped by a test
It asks for a challenge
The edge looks at the network the visit comes from and hands back a small math puzzle. Riskier networks get a harder one.
POST /v1/challenge → sealed challenge with sha256-v1 difficulty
The browser does the work
In the background, the browser solves the puzzle and notes a few yes-or-no facts about itself. The person keeps typing.
SHA-256 hashcash in WebAssembly, in a Web Worker · encrypted signals
The edge scores the visit
The edge checks the work and scores the visit from 1.0 (a person) to 0.0 (a bot), with plain reasons.
POST /v1/solve · rules-v1 · each challenge accepted once
A one-time pass comes back
The browser gets a sealed pass, tied to your site and this action, that expires in five minutes.
AES-256-GCM sealed token · 300 s · hostname- and action-bound
The form is sent
Your form posts as usual, with the pass in a hidden field.
field: revokegpt-response (or g-recaptcha-response in compatibility mode)
Your server checks the pass
Your server sends the pass and your secret key to our API. One request, from your server only.
POST api.revokegpt.com/v1/siteverify · secret rgsk_… · browsers refused
The pass is spent
We mark the pass used, so a copy is worthless, and answer with the score and reasons.
Spent once in a Durable Object · a replay gets timeout-or-duplicate
You decide
Let the person in, ask for an email code, or block. The rules are yours.
if (score < 0.5) …
Try the scoring yourself.
Every check ends in a score from 1.0 (a person) to 0.0 (a bot), with reasons. Flip the switches to see what changes.
- Proof-of-work
- Light
- Reasons
- none
- Invisible mode
- Passes silently
- Your server (min score 0.5)
- Allows
A simplified picture of our scoring rules. The real rules weigh many more signals.
Hard for bots, invisible for people.
- 01
Work that costs bots
Every visit solves a SHA-256 proof-of-work in WebAssembly. Cheap once, expensive a million times. Risky networks get harder sums.
- 02
Signals, not identity
Browser, network and speed signals become yes-or-no facts. We never build a profile of a person or follow them across sites.
- 03
Passes that work once
Each pass is sealed, bound to your site and action, lives five minutes and is spent the first time it is checked.
- 04
Keys useless if stolen
Site keys only work on your domains. Secret keys are stored as a keyed hash and shown once. siteverify refuses browsers.
- 05
Puzzles only as a backup
Slider, rotate, odd-one-out and an audio option in 8 languages, shown only when a score is very low. One try each.
- 06
Fair to privacy tools
VPN, Tor, iCloud Private Relay and Brave users are not punished with puzzles. They just do a little more work.
Set it up in three steps.
Or skip the reading: get a site key and paste our prompt into Cursor, Claude Code, Lovable, Bolt or v0.
- 1
Create a site
Sign up, add your domain and pick a mode. You get a public site key (
rgpk_…) and a secret key (rgsk_…), shown once. Keep the secret on your server. - 2
Add the widget to your form
sign-up.html
<script src="https://js.revokegpt.com/v1/api.js" async defer></script> <form action="/sign-up" method="post"> <div class="revokegpt" data-sitekey="rgpk_..." data-action="signup"></div> <button>Create account</button> </form> - 3
Check the pass on your server
server.js
const res = await fetch('https://api.revokegpt.com/v1/siteverify', { method: 'POST', body: new URLSearchParams({ secret: process.env.REVOKEGPT_SECRET, response: req.body['revokegpt-response'], }), }); const r = await res.json(); if (!r.success || r.hostname !== 'shop.example' || r.score < 0.5) { return reply.status(403).send('Blocked'); }Already on reCAPTCHA? Swap the script to
js.revokegpt.com/recaptcha/api.jsand siteverify toapi.revokegpt.com/recaptcha/api/siteverify. See migration.
Checks run at the edge. The database stays out of the way.
Every challenge, score and siteverify runs on Cloudflare Workers, close to your visitors. Spending a pass happens in a Durable Object, so a pass can never be used twice, even in two cities at once. Your account data lives in a Postgres database in the EU, which is never on the path of a check.
- EdgeCloudflare Workers · KV · Durable Objects
- WidgetWebAssembly proof-of-work · Web Worker
- DataSupabase Postgres, EU region
- Dashboardapp.revokegpt.com