Verify every response on your server.

The browser widget supplies a short-lived token. Your backend must exchange that token with Verinexa, validate the returned context, and only then perform the protected action.

View cURL request Integration overview

1 Receive token2 Verify privately3 Validate context

01Form-encoded cURL

Send the secret and token from the backend.

Use --data-urlencode so every field is encoded safely. The private secret must never appear in browser code.

curl --silent --show-error --fail-with-body \
  --request POST "https://verinexa.ikembatech.com.au/api/v1/siteverify" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "secret=vx_secret_replace_me" \
  --data-urlencode "response=RESPONSE_TOKEN" \
  --data-urlencode "remoteip=203.0.113.10" \
  --data-urlencode "action=account-registration"

02JSON request

JSON is supported as an alternative.

Use a real JSON encoder when values are dynamic. Avoid concatenating untrusted values into a JSON string.

curl --silent --show-error --fail-with-body \
  --request POST "https://verinexa.ikembatech.com.au/api/v1/siteverify" \
  --header "Content-Type: application/json" \
  --data '{
    "secret": "vx_secret_replace_me",
    "response": "RESPONSE_TOKEN",
    "remoteip": "203.0.113.10",
    "action": "account-registration"
  }'

03Successful response

HTTP 200 is not the final decision.

Require explicit success, an empty error list, the expected action, an allowed hostname, and an acceptable score.

{
  "success": true,
  "challenge_ts": "2026-07-30 21:42:18",
  "hostname": "example.com",
  "score": 0.82,
  "score_threshold": 0.5,
  "action": "account-registration",
  "error-codes": []
}

Required validation

Fail closed unless the complete context matches.

The widget animation is not a trust decision. The backend response is the source of truth.

Success

Require success to be exactly true.

Error list

Require error-codes to be empty.

Action

Match the exact workflow expected by the current handler.

Hostname

Compare against an explicit hostname allowlist.

Score

Meet the site threshold and any stricter application rule.

Token lifecycle

Expired or consumed tokens require a fresh challenge.

Token failures

Processed requests can still be rejected.

These responses use HTTP 200 because the verification endpoint processed the request. Inspect success and error-codes.

Expired or duplicate

{
  "success": false,
  "error-codes": ["timeout-or-duplicate"]
}

Reset the widget and request a new token.

Action mismatch

{
  "success": false,
  "action": "contact-form",
  "error-codes": ["action-mismatch"]
}

The token is consumed and cannot be retried.

Low score

{
  "success": false,
  "score": 0.34,
  "score_threshold": 0.5,
  "error-codes": ["low-score"]
}

Reject or require a new, stronger challenge.

Remote-IP mismatch

{
  "success": false,
  "error-codes": ["remoteip-mismatch"]
}

Review the trusted-proxy and client-IP configuration.

HTTP failures

Handle request and service errors separately.

Status	Example error	Required handling
`400`	`missing-input-secret`, `invalid-input-secret`, `missing-input-response`	Fix the integration or obtain a new token. Do not run the protected action.
`429`	`rate-limit-exceeded`	Apply controlled backoff and inspect unexpected verification volume.
`503`	`database-unavailable`, `database-schema-outdated`, `rate-limiter-unavailable`	Fail closed, alert operators, and show a neutral temporary-unavailability message.

04PHP cURL

Set transport timeouts and validate every field.

The full package includes a production-oriented raw cURL example and a reusable PHP SDK.

$result = $verifier->verify(
    $_POST['verinexa-response'] ?? '',
    $_SERVER['REMOTE_ADDR'] ?? null,
    'account-registration'
);

$allowedHosts = ['example.com', 'www.example.com'];

$valid = $result->isSuccess()
    && $result->errors() === []
    && $result->action() === 'account-registration'
    && in_array(strtolower((string) $result->hostname()), $allowedHosts, true)
    && $result->score() >= 0.50;

if (!$valid) {
    http_response_code(422);
    exit('Verification failed. Please try again.');
}

// Perform the protected action exactly once.

Complete packaged reference

Deployment details are included with Verinexa.

See docs/SERVER-SIDE-VERIFICATION.md for Windows cURL commands, complete payloads, raw PHP cURL, proxy guidance, visitor-safe errors, replay rules, and the full error-code table.

docs/SERVER-SIDE-VERIFICATION.mddocs/API.mdsdk/php/VerinexaVerifier.php

Get site credentials