InfoPeak Captcha for Python

Server-side verification for InfoPeak Captcha - the privacy-first, EU-hosted captcha. No tracking, no cookies, no image puzzles.

Install

pip install infopeak-captcha

Requires Python 3.8+. Zero dependencies (standard library only).

Usage

Add the widget to your form (full guide):

<form action="/signup" method="POST">
  <input type="email" name="email" required>
  <div class="infopeak-captcha" data-sitekey="YOUR_SITEKEY"></div>
  <button type="submit">Sign up</button>
</form>
<script src="https://captcha.infopeak.io/infopeak-captcha.js" defer></script>

Verify the token when the form is submitted (Flask example):

import os
from infopeak_captcha import verify, FIELD

@app.post("/signup")
def signup():
    if not verify(
        request.form.get(FIELD),
        sitekey="YOUR_SITEKEY",
        secret=os.environ["INFOPEAK_CAPTCHA_SECRET"],
    ):
        return "Captcha verification failed", 400
    # ... proceed

Django works the same way with request.POST.get(FIELD).

Need quota information too?

from infopeak_captcha import verify_detailed

result = verify_detailed(token, sitekey="YOUR_SITEKEY", secret="YOUR_SECRET")
result.valid       # True when the token was genuine and unused
result.over_limit  # True when the sitekey is over its monthly quota

Verification fails closed: network errors and non-200 responses return valid=False.

Retrying a rejected submission

Tokens are single-use. If you reject a submission and leave the visitor on the same page - an AJAX form, a wrong password, a validation error - the token already in the form is spent, and the next attempt fails on the captcha instead of on the real problem. Ask the widget for a fresh one:

window.infopeakCaptcha.reset();

// Or one specific widget, by element or CSS selector.
window.infopeakCaptcha.reset('#signup-captcha');

reset() clears the hidden field and solves again immediately, and returns the number of widgets it reset. Plain form posts do not need this - the page reload builds a new widget anyway.

Testing

Public test credentials that work on any domain and never count against a quota (never use in production):

sitekey: ipk_test_sitekey
secret:  ipk_test_secret

Links

• Get a free sitekey - 10,000 verifications/month at no cost
• Developer documentation

License

MIT