Terms
These terms describe the current EphCaptcha service and the responsibilities created by using it.
What the service provides
EphCaptcha provides an embeddable interaction challenge, server-issued verification tokens, and a server-side verification endpoint. Tokens are single-use, expire after 10 minutes, and are bound to the hostname where the challenge was completed. Paid-site tokens are also bound to their site key.
Your integration responsibility
You must verify every token from your own backend before accepting a protected submission. You must send your expected hostname and, for a paid widget, its site key. You must fail closed: a missing token, network error, timeout, non-200 response, or response with success: false must not be treated as verification.
Plans and payment
The Free plan does not require payment. Pro and Enterprise are monthly subscriptions created through Stripe Checkout at the prices shown on the site. EphCaptcha unlocks a paid tier only after Stripe reports the Checkout Session as paid.
Permitted use
Do not use EphCaptcha to abuse the service, evade rate limits, inflate public counters, probe other customers’ site keys, replay tokens, or interfere with availability. A site key may be domain-locked when first used.
Availability
EphCaptcha is designed to fail closed when token issuance or verification is unavailable. That protects forms from being silently accepted, but it can temporarily prevent protected submissions. Integrators should display a retry message and avoid treating outages as successful verification.
Contact
Questions can be sent to ephcaptcha@gmail.com.