Skip to main content
ALTCHA®

Quick Start

ALTCHA protects your forms from bots with an invisible, privacy-friendly proof-of-work challenge — no CAPTCHAs, no tracking, no user friction. This guide gets a working integration in place in a few minutes. It covers the moving pieces at a high level; each step links out to a dedicated page with the full details.

An ALTCHA integration has three parts:

  1. Widget — embedded in your form, computes the proof-of-work challenge in the browser.
  2. Challenge generation — your server (or ALTCHA Sentinel) issues a fresh challenge to the widget.
  3. Verification — your server checks the solved challenge before accepting the submission.

Before you begin

You'll need:

  • A website or application served over HTTPS — the widget requires a secure context.
  • A way to generate challenges: either ALTCHA Sentinel or ALTCHA Cloud (no backend code required), or your own server using one of the official libraries.

Step 1 — Add the widget

Install via npm:

npm install altcha
import "altcha";

Or load it from a script tag:

<script async defer src="https://cdn.jsdelivr.net/gh/altcha-org/altcha/dist/main/altcha.min.js" type="module"></script>

Then add the <altcha-widget> element to your form, pointing challenge at your challenge endpoint:

<form method="POST" action="/submit">
  <!-- your form fields -->

  <altcha-widget challenge="{YOUR_SERVER_HERE}"></altcha-widget>

  <button type="submit">Send</button>
</form>

The widget renders as a lightweight, accessible verification element and adds a hidden altcha field to your form with the verification payload. See the Widget Integration page for configuration, theming, and internationalization.

Step 2 — Generate challenges

Your server must return a fresh, single-use challenge whenever the widget requests one.

  • Using ALTCHA Sentinel or Cloud — challenges are generated for you. Point the widget's challenge attribute directly at your Sentinel/Cloud endpoint URL, no backend code needed.
  • Using your own server — expose an endpoint that returns a new challenge on each request, using one of the official server libraries.

Step 3 — Verify submissions

Every submission must be verified server-side — the widget alone doesn't protect you. In your form handler, read the altcha field and verify it:

  • With Sentinel or Cloud — verify the payload using verifyServerSignature from a library, or call the verification endpoint directly.
  • Without Sentinel — verify the payload using verifySolution from a library.

See the Server Integration page for library-specific examples.

Step 4 — Test it

  1. Load your page and confirm the widget renders inside the form.
  2. Submit without completing verification — your server should reject it.
  3. Complete verification and submit — it should succeed.

Next steps

Start typing to search...

↑ ↓ Navigate ↵ Select