Captcha Manager

CosasDNS' own captcha for the websites you manage.

Own captcha

Protect your forms without third parties

Captcha Manager provides CosasDNS' own captcha for your websites: image, hybrid or invisible, always with proof-of-work, an API key and a list of allowed domains. No Google reCAPTCHA, hCaptcha or Turnstile.

Get started

There is no sign-up here: the button takes you to admin.cosasdns.com, where you use your usual session.

What it includes

Three modes, proof-of-work and per-app control to validate the captcha on your website.

Local captcha

The image is generated and validated by CosasDNS. No external provider and no third-party keys.

Proof-of-work required

In all three modes, the client solves a proof-of-work challenge before validation. No PoW, no validation.

API key per app

Each integration has its own API key. It is sent in the X-API-Key header.

Allowed domains

Allow exact domains (sub.test.com) or wildcards (*.test.com). The server checks Origin and Referer against that list.

Request limits

The API applies a rate limit per key and IP to curb abuse.

Clear errors

401 for an invalid API key, 403 for a domain that is not allowed, 429 when the limit is exceeded and 422 when data is missing.

Three verification modes

Each app decides how to request verification. Proof-of-work is always required.

Image

Always asks for the image code and proof-of-work. It is the most explicit mode and the safe fallback.

Hybrid

Calculates an invisible score; if risk rises, it shows the image. It also allows forcing the image manually.

Invisible

Calculates the score without showing an image; if risk rises, it automatically falls back to image and PoW.

Management lives in the Admin

Captcha Manager has no panel of its own: everything is configured in admin.cosasdns.com → Dashboard → Captcha.

1

Open the Admin

Open admin.cosasdns.com with your CosasDNS account. If you have no session, the Admin itself lets you log in or sign up.

2

Open Captcha

In the Dashboard, inside the APIs block, click Captcha.

3

Create the app and copy the key

Give it a title, add the domains, enable the app and copy the API key to your website.

Go to the Admin

Session, login and sign-up belong to admin.cosasdns.com. This landing never asks for credentials.

How it integrates

The selected mode changes the challenge, but the flow is the same:

  1. Your website requests a challenge from the API with its API key; the app decides image or token based on its mode and risk.
  2. The user solves the image and proof-of-work, or only proof-of-work when the mode returns a single-use token.
  3. The API checks the API key, domain, PoW, risk and rate limit, and consumes the token when applicable.
  4. If everything matches, it returns the validation to your form.

Integration code

Add the component to the form and validate the captcha on your server before processing the data.

1. Client (JavaScript)

The component renders the image or solves the invisible challenge, computes proof-of-work and adds captcha_id, captcha_input, captcha_token and pow_* to the payload.

<script type="module">
import CosasCaptchaForm from 'https://cdn.cosasdns.com/components/captcha/form.js?v=160';

new CosasCaptchaForm({
  form: '#contact-form',
  result: '#form-result',
  captchaContainer: '#captcha',
  apiKey: 'TU_API_KEY',
  lang: 'es',

  // El componente añade captcha_id, captcha_input, captcha_token y pow_* al payload.
  submit: async (payload) => {
    const response = await fetch('/contact.php', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(payload)
    });

    return response.json();
  }
}).init();
</script>

2. Server (PHP)

Send id/input for image mode and captcha_token for invisible/hybrid. Validate against the API with the same API key and form domain; do not process the form when valid is false.

<?php
$payload = json_decode(
    file_get_contents('php://input'),
    true,
    512,
    JSON_THROW_ON_ERROR
);

$ch = curl_init('https://api.cosasdns.com/captcha/app/validate');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-API-Key: ' . getenv('CAPTCHA_API_KEY'),
        'X-Captcha-Domain: ' . $_SERVER['HTTP_HOST'],
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'id' => $payload['captcha_id'] ?? '',
        'input' => $payload['captcha_input'] ?? '',
        'captcha_token' => $payload['captcha_token'] ?? '',
        'pow_challenge' => $payload['pow_challenge'] ?? '',
        'pow_signature' => $payload['pow_signature'] ?? '',
        'pow_nonce' => $payload['pow_nonce'] ?? '',
    ], JSON_THROW_ON_ERROR),
]);

$response = curl_exec($ch);
curl_close($ch);

$result = json_decode((string) $response, true, 512, JSON_THROW_ON_ERROR);

if (!($result['data']['valid'] ?? false)) {
    http_response_code(422);
    exit('Captcha inválido');
}

// Continúa con el alta, contacto, etc.

The API key is restricted to the app domains. Do not use it as a replacement for server-side validation: the browser can skip any client-side check.

Frequently asked questions

Do I need another account?

No. Captcha Manager uses the account and session of admin.cosasdns.com. From this landing we only take you there.

Does it use reCAPTCHA, hCaptcha or Turnstile?

No. The captcha is our own: an image generated by CosasDNS plus a mandatory proof-of-work. Each app can use image, hybrid or invisible mode.

How do I limit which websites can use my API key?

Each app has its own domain list. You can allow the exact domain or a wildcard such as *.test.com. The API checks Origin and Referer against that list.

Where can I see the API key?

In Admin → Dashboard → Captcha. The key can be viewed and rotated there; it is never shown on this landing.

What happens if someone uses my key from another domain?

The API returns 403 and does not validate the captcha: the origin domain is not in the app's list.