verify-route.md

Using the /verify Route

Framework plugins include a /verify endpoint that can be used internally or by external services to verify ALTCHA payloads.

Usage

Send the Base64-encoded payload returned by the ALTCHA widget as the altcha field. This value is typically obtained from a form field or a cookie.

const resp = await fetch('http://localhost:3000/altcha/verify', {
  body: JSON.stringify({
    altcha: '...', // Base64-encoded ALTCHA payload
  }),
  headers: {
    'content-type': 'application/json',
  },
  method: 'POST',
});

const result = resp.status === 200 ? await resp.json() : null;

if (result?.verification?.verified === true) {
  // Success
}

Note: The field name altcha can be changed using the fieldName option in the create() configuration.

Note: This route always verifies locally, even if verifyServer is configured — it never calls out to Sentinel. It's meant for external/custom integrations that trust your server's own hmacSignatureSecret-based check. If a custom integration needs remote Sentinel verification, call the exported verifyServer() function directly. See /docs/server-signatures.md.

Verification Result

interface AltchaResult {
  error: string | null;
  payload: Payload | ServerSignaturePayload | null;
  verification: VerifySolutionResult | null;
}

interface VerifySolutionResult {
  expired: boolean;
  invalidSignature: boolean | null;
  invalidSolution: boolean | null;
  time: number;
  verified: boolean;
}