Documentation

<!-- Load the widget script once, anywhere on the page -->
<script src="https://reforgecaptcha.cloud/assets/js/widget.js" async defer></script>

<form method="POST" action="/submit">

  <!-- Your form fields -->
  <input type="email" name="email" placeholder="you@example.com">

  <!-- The widget div -->
  <div class="reforge-captcha"
       data-sitekey="site_YOUR_SITE_KEY"
       data-theme="auto"
       data-type="checkbox">
  </div>

  <button type="submit">Submit</button>
</form>

<?php
$token  = $_POST['reforge-captcha-token'] ?? '';
$secret = 'secret_YOUR_SECRET_KEY';

$response = file_get_contents('https://reforgecaptcha.cloud/api/verify', false,
    stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => 'Content-Type: application/json',
        'content' => json_encode(['secret' => $secret, 'token' => $token]),
    ]])
);

$result = json_decode($response, true);

if (!$result['success']) {
    // Bot or verification failed
    http_response_code(403);
    exit('CAPTCHA verification failed.');
}

if ($result['score'] < 0.5) {
    // Suspicious — optionally require extra verification
    exit('Request flagged as suspicious.');
}

// Human confirmed — process the form
?>

const fetch = require('node-fetch'); // or native fetch in Node 18+

app.post('/submit', async (req, res) => {
    const token  = req.body['reforge-captcha-token'];
    const secret = 'secret_YOUR_SECRET_KEY';

    const resp = await fetch('https://reforgecaptcha.cloud/api/verify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ secret, token }),
    });

    const result = await resp.json();

    if (!result.success || result.score < 0.5) {
        return res.status(403).json({ error: 'CAPTCHA failed' });
    }

    // Process the form...
    res.json({ ok: true });
});

<div class="reforge-captcha"
     data-sitekey="site_YOUR_SITE_KEY"
     data-type="checkbox"
     data-theme="auto">
</div>

<div class="reforge-captcha"
     data-sitekey="site_YOUR_SITE_KEY"
     data-type="invisible">
</div>

<div class="reforge-captcha"
     data-sitekey="site_YOUR_SITE_KEY"
     data-type="managed"
     data-theme="dark">
</div>

<div class="reforge-captcha"
     data-sitekey="site_YOUR_SITE_KEY"
     data-type="image"
     data-theme="auto">
</div>

POST https://reforgecaptcha.cloud/api/verify
Content-Type: application/json

{
  "secret": "secret_YOUR_SECRET_KEY",
  "token":  "TOKEN_FROM_FORM_SUBMISSION"
}

curl -X POST https://reforgecaptcha.cloud/api/verify \
  -H "Content-Type: application/json" \
  -d '{"secret":"secret_YOUR_SECRET_KEY","token":"USER_TOKEN"}'

POST https:/reforgecaptcha.cloud/api/widget-token
Content-Type: application/json

{
  "sitekey":         "site_YOUR_SITE_KEY",
  "type":            "checkbox",
  "hostname":        "example.com",
  "mouse_movements": 14,
  "time_ms":         3200
}

{
  "success":      true,
  "challenge_ts": "2025-01-15 14:32:07",
  "hostname":     "example.com",
  "score":        0.92,
  "action":       "",
  "error-codes":  []
}

// In your controller
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;

public function submit(Request $request)
{
    $response = Http::post('https://reforgecaptcha.cloud/api/verify', [
        'secret' => config('services.reforge.secret'),
        'token'  => $request->input('reforge-captcha-token'),
    ])->json();

    if (!$response['success'] || $response['score'] < 0.5) {
        return back()->withErrors(['captcha' => 'CAPTCHA verification failed.']);
    }

    // Process the form...
}

<?php
// In your form handler
$token  = sanitize_text_field($_POST['reforge-captcha-token'] ?? '');
$secret = get_option('reforge_secret_key');

$response = wp_remote_post('https://reforgecaptcha.cloud/api/verify', [
    'body'    => json_encode(['secret' => $secret, 'token' => $token]),
    'headers' => ['Content-Type' => 'application/json'],
]);

$result = json_decode(wp_remote_retrieve_body($response), true);

if (!$result['success']) {
    wp_die('CAPTCHA verification failed.');
}

import requests

def verify_captcha(token: str) -> bool:
    resp = requests.post(
        'https://reforgecaptcha.cloud/api/verify',
        json={
            'secret': 'secret_YOUR_SECRET_KEY',
            'token':  token,
        },
        timeout=5,
    )
    data = resp.json()
    return data.get('success') and data.get('score', 0) >= 0.5

# In your view
def contact(request):
    if request.method == 'POST':
        token = request.POST.get('reforge-captcha-token', '')
        if not verify_captcha(token):
            return HttpResponseForbidden('CAPTCHA failed')
        # process form...

// pages/api/submit.js (Next.js API route)
export default async function handler(req, res) {
    if (req.method !== 'POST') return res.status(405).end();

    const { 'reforge-captcha-token': token, ...formData } = req.body;

    const verify = await fetch('https://reforgecaptcha.cloud/api/verify', {
        method:  'POST',
        headers: { 'Content-Type': 'application/json' },
        body:    JSON.stringify({
            secret: process.env.REFORGE_SECRET_KEY,
            token,
        }),
    });

    const result = await verify.json();

    if (!result.success || result.score < 0.5) {
        return res.status(403).json({ error: 'CAPTCHA failed' });
    }

    // Handle formData...
    res.status(200).json({ ok: true });
}

// Component
// Load <script src="https://reforgecaptcha.cloud/assets/js/widget.js" /> in _document.js
// Then use the div in your form:
// <div className="reforge-captcha" data-sitekey="site_KEY" data-type="checkbox" />