# Agent402 CAPTCHA Server-Side Verification

> Agent402 CAPTCHA Server-Side Verification is a paid API for AI agents from agent402.tools, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Validates a Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha client token server-side by relaying to the provider's siteverify endpoint and returning a normalized pass/fail verdict

## Facts

- Endpoint: POST https://agent402.tools/api/captcha-verify
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-captcha-server-side-verification-b09f699b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0IpKVhDHBDBLypHQdqkng

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-captcha-server-side-verification-b09f699b -d '<json body>'
```

Example prompt: Verify this reCAPTCHA token server-side for me — the token from the client is '03AGdBq25...', my reCAPTCHA secret key is '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', provider is recaptcha, and the client IP is 203.0.113.42.

## When to prefer this

Use this endpoint when your agent needs to validate a CAPTCHA token server-side without managing direct HTTP calls to each provider's siteverify API. Ideal when you need provider-agnostic normalized results across Turnstile, reCAPTCHA, and hCaptcha, or when operating in an environment where making outbound HTTP calls to Google/Cloudflare/hCaptcha is inconvenient. The secret key is never logged or stored.

## Known failure modes

- Invalid or expired token returns success:false with error codes from the provider
- Wrong secret key causes provider authentication failure
- Unknown provider value returns a 400-level validation error
- Network timeout reaching the upstream provider siteverify endpoint
- Token already consumed (replay) returns success:false

## How this service works

Validate a Cloudflare Turnstile, Google reCAPTCHA, or hCaptcha token server-side. You pass your OWN provider secret plus the token from the client; we relay to the provider's siteverify endpoint (never logged) and return the normalized verdict (success, hostname, action, score, error codes). The legitimate backend half of bot protection - no solving, no bypass.

## Output

A normalized verdict object indicating whether the captcha token is valid (success true/false), along with any provider-specific metadata returned from the siteverify endpoint such as score, action, hostname, or error codes.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "token": {
   "type": "string",
   "description": "the captcha response token from the client"
  },
  "secret": {
   "type": "string",
   "description": "your provider secret key (relayed to the provider, never stored/logged)"
  },
  "provider": {
   "type": "string",
   "description": "turnstile | recaptcha | hcaptcha"
  },
  "remoteip": {
   "type": "string",
   "description": "optional client IP to pass through"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "success": true,
  "hostname": "example.com",
  "provider": "turnstile",
  "errorCodes": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-captcha-server-side-verification-b09f699b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)