Stop form spam without a CAPTCHA.

<!-- 1. Load the script once, with your public key -->
<script src="https://bot403.com/v1/bot403.js" data-bot403-key="pk_live_YOUR_PUBLIC_KEY" async></script>

<!-- 2. Keep your form as it is. Every form on the page is protected -->
<form action="/contact" method="POST">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

<!-- 3. On your server, post the _bot403 field to /api/v1/verify. See the server tabs. -->

// npm install @bot403/browser, or load the script tag and call Bot403.solve()
import { solve, FIELD } from "@bot403/browser";

// 1. Get a token. The proof of work runs in a Web Worker
const token = await solve("pk_live_YOUR_PUBLIC_KEY");

// 2. Send the token with your data. Your server posts it to /api/v1/verify
await fetch("/contact", {
  method: "POST",
  body: new URLSearchParams({ email: "[email protected]", message: "Hello", [FIELD]: token }),
});

// npm install @bot403/react
import { useBot403, FIELD } from "@bot403/react";

export function ContactForm() {
  // 1. Loads the script on mount; getToken() returns a fresh single-use token
  const getToken = useBot403("pk_live_YOUR_PUBLIC_KEY");
  async function onSubmit(e) {
    e.preventDefault();
    const body = new URLSearchParams(new FormData(e.currentTarget));
    // 2. Add the token before you post the form to your server
    body.set(FIELD, await getToken());
    await fetch("/contact", { method: "POST", body });
  }
  return (
    <form onSubmit={onSubmit}>
      <input name="email" type="email" required />
      <textarea name="message" required />
      <button>Send</button>
    </form>
  );
}

# Claude Code
claude mcp add --transport http bot403 https://bot403.com/mcp

# Codex
codex mcp add bot403 --url https://bot403.com/mcp

# Then ask, for example:
# "Protect the contact form in this project with Bot403."

// npm install @bot403/node express
import express from "express";
import { Bot403 } from "@bot403/node";

// Keep the secret key on the server: BOT403_SECRET_KEY=sk_live_YOUR_SECRET_KEY
const bot403 = new Bot403({ secretKey: process.env.BOT403_SECRET_KEY });
const app = express();
app.use(express.urlencoded({ extended: false }));

app.post("/contact", async (req, res) => {
  // 1. Post the whole form. Bot403 reads the _bot403 field and the honeypot field
  const result = await bot403.verifyForm(req.body);

  // 2. Refuse when ok is false, except for reason "quota"
  if (!result.ok && result.reason !== "quota") return res.status(400).send("Try again");
  res.send("Thanks.");
});

app.listen(3000);

<?php
// Keep the secret key on the server: BOT403_SECRET_KEY=sk_live_YOUR_SECRET_KEY
// 1. Post the whole form. Bot403 reads the _bot403 field and the honeypot field
$ch = curl_init("https://bot403.com/api/v1/verify");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_HTTPHEADER => ["Authorization: Bearer " . getenv("BOT403_SECRET_KEY")],
  CURLOPT_POSTFIELDS => http_build_query($_POST),
  CURLOPT_RETURNTRANSFER => true,
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

// 2. Refuse when ok is false, except for reason "quota"
if (!$result["ok"] && $result["reason"] !== "quota") {
  http_response_code(400);
  exit("Try again");
}

import os
import requests
from flask import abort, request

# Keep the secret key on the server: BOT403_SECRET_KEY=sk_live_YOUR_SECRET_KEY
# 1. Post the whole form. Bot403 reads the _bot403 field and the honeypot field
r = requests.post(
    "https://bot403.com/api/v1/verify",
    headers={"Authorization": "Bearer " + os.environ["BOT403_SECRET_KEY"]},
    data=request.form,
    timeout=5,
)
result = r.json()

# 2. Refuse when ok is false, except for reason "quota"
if not result["ok"] and result.get("reason") != "quota":
    abort(400)

package main

import (
    "encoding/json"
    "net/http"
    "os"
    "strings"
)

// Keep the secret key on the server: BOT403_SECRET_KEY=sk_live_YOUR_SECRET_KEY
func contact(w http.ResponseWriter, r *http.Request) {
    r.ParseForm()
    // 1. Post the whole form. Bot403 reads the _bot403 field and the honeypot field
    req, _ := http.NewRequestWithContext(r.Context(), "POST", "https://bot403.com/api/v1/verify", strings.NewReader(r.PostForm.Encode()))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("BOT403_SECRET_KEY"))
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    var result struct {
        OK     bool
        Reason string
    }
    res, err := http.DefaultClient.Do(req)
    if err == nil {
        defer res.Body.Close()
        json.NewDecoder(res.Body).Decode(&result)
    }

    // 2. Refuse when ok is false, except for reason "quota". On err, let the form through
    if err == nil && !result.OK && result.Reason != "quota" {
        http.Error(w, "Try again", http.StatusBadRequest)
        return
    }
    w.Write([]byte("Thanks."))
}

func main() {
    http.HandleFunc("POST /contact", contact)
    http.ListenAndServe(":3000", nil)
}

require "net/http"
require "json"

# Keep the secret key on the server: BOT403_SECRET_KEY=sk_live_YOUR_SECRET_KEY
# 1. Post the whole form. Bot403 reads the _bot403 field and the honeypot field
uri = URI("https://bot403.com/api/v1/verify")
req = Net::HTTP::Post.new(uri, "Authorization" => "Bearer " + ENV["BOT403_SECRET_KEY"])
req.set_form_data(request.POST)
res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") { |http| http.request(req) }
result = JSON.parse(res.body)

# 2. Refuse when ok is false, except for reason "quota"
halt 400, "Try again" if !result["ok"] && result["reason"] != "quota"