Captcha Manager

CosasDNS' own captcha for the websites you manage.

Own captcha

Protect your forms without third parties

Captcha Manager provides CosasDNS' own captcha for your websites: image and proof-of-work, with an API key and a list of allowed domains. No Google reCAPTCHA, hCaptcha or Turnstile.

Get started

There is no sign-up here: the button takes you to admin.cosasdns.com, where you use your usual session.

What it includes

Everything you need to validate the captcha on your website.

Local captcha

The image is generated and validated by CosasDNS. No external provider and no third-party keys.

Proof-of-work required

Before the captcha is validated, the client solves a proof-of-work challenge. No PoW, no validation.

API key per app

Each integration has its own API key. It is sent in the X-API-Key header.

Allowed domains

Allow exact domains (sub.test.com) or wildcards (*.test.com). The server checks Origin and Referer against that list.

Request limits

The API applies a rate limit per key and IP to curb abuse.

Clear errors

401 for an invalid API key, 403 for a domain that is not allowed, 429 when the limit is exceeded and 422 when data is missing.

Management lives in the Admin

Captcha Manager has no panel of its own: everything is configured in admin.cosasdns.com → Utilities → Captcha Manager.

1

Open the Admin

Open admin.cosasdns.com with your CosasDNS account. If you have no session, the Admin itself lets you log in or sign up.

2

Open Captcha Manager

In Utilities, right before Secret Manager, you will find Captcha Manager.

3

Create the app and copy the key

Give it a title, add the domains, enable the app and copy the API key to your website.

Go to the Admin

Session, login and sign-up belong to admin.cosasdns.com. This landing never asks for credentials.

How it integrates

The flow is always the same:

  1. Your website requests a challenge from the API with its API key.
  2. The user solves the image and the proof-of-work.
  3. The API checks the API key, the domain, the PoW and the rate limit.
  4. If everything matches, it returns the validation to your form.

Frequently asked questions

Do I need another account?

No. Captcha Manager uses the account and session of admin.cosasdns.com. From this landing we only take you there.

Does it use reCAPTCHA, hCaptcha or Turnstile?

No. The captcha is our own: an image generated by CosasDNS plus a proof-of-work that is required before validation.

How do I limit which websites can use my API key?

Each app has its own domain list. You can allow the exact domain or a wildcard such as *.test.com. The API checks Origin and Referer against that list.

Where can I see the API key?

In Admin → Utilities → Captcha Manager. The key can be viewed and rotated there; it is never shown on this landing.

What happens if someone uses my key from another domain?

The API returns 403 and does not validate the captcha: the origin domain is not in the app's list.