Success
Require the verification response to explicitly indicate success.
Add human verification without handing trust to the browser.
Render the Verinexa widget, receive a short-lived response, then call the private verification endpoint before processing the form, account, transaction, or API action.
1 Render widget2 Receive token3 Verify server-side
01Browser integration
Place the widget inside the protected form.
The public site key identifies the policy. The action labels the business workflow. Neither the private secret nor trust decision belongs in the page.
<script src="https://verinexa.ikembatech.com.au/assets/captcha.js?v=1785451630" defer></script>
<form method="post" action="/register-account.php">
<!-- Your normal form fields -->
<div class="verinexa-captcha"
data-sitekey="YOUR_SITE_KEY"
data-action="account-registration"
data-api-base="https://verinexa.ikembatech.com.au/"></div>
<button type="submit">Create account</button>
</form>02Verification request
Call siteverify from your server.
Send the private secret, browser response, expected action, and—when safely resolved—the visitor IP. HTTP 200 means the request was processed, not necessarily accepted.
curl --silent --show-error --fail-with-body \ --request POST "https://verinexa.ikembatech.com.au/api/v1/siteverify" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "secret=vx_secret_replace_me" \ --data-urlencode "response=RESPONSE_TOKEN" \ --data-urlencode "remoteip=203.0.113.10" \ --data-urlencode "action=account-registration"
03Response validation
Validate the complete response context.
Require explicit success, an empty error list, the expected action and hostname, and an acceptable risk score before the protected operation.
{
"success": true,
"challenge_ts": "2026-07-30 21:42:18",
"hostname": "example.com",
"score": 0.82,
"score_threshold": 0.5,
"action": "account-registration",
"error-codes": []
}04Backend verification
Validate the response before the protected action.
Send the response token and private secret to /api/v1/siteverify. Then enforce success, expected action, hostname, and your minimum score.
$result = $verifier->verify(
$_POST['verinexa-response'] ?? '',
$_SERVER['REMOTE_ADDR'] ?? null,
'account-registration'
);
if (!$result->isSuccess()
|| $result->action() !== 'account-registration'
|| $result->hostname() !== 'example.com'
|| $result->score() < 0.50) {
http_response_code(422);
exit('Verification failed.');
}
// Run the protected action only here.Validation checklist
Fail closed and validate the complete context.
A successful widget animation is not enough. The backend response is the source of truth.
Action
Match the response to the exact form or operation being protected.
Hostname
Confirm that the response originated from the expected site.
Score
Enforce the platform policy and any stricter application-level threshold.
Expiry
Reject expired responses and ask the user to complete a new challenge.
Single use
Do not retry the same consumed token after business validation fails.
Detailed reference
Handle every verification response safely.
The bundled server-side guide covers form and JSON cURL, Windows commands, HTTP statuses, token replay, action/hostname/score validation, PHP cURL, proxy handling, and all verification error codes.
docs/SERVER-SIDE-VERIFICATION.mddocs/API.mdsdk/php/VerinexaVerifier.phpCore endpoints
A small verification API surface.
POST /api/v1/challengePOST /api/v1/solvePOST /api/v1/siteverifyGET /health