Documentation

Bot403 is an invisible bot shield for HTML forms: one script tag makes the browser solve a small proof of work, and your server checks it with one call.

Updated 23 October 2026

Start in 5 minutes

Sign in with your email and create a site. Copy its public key (pk_) and secret key (sk_).
Add the script tag to the page with your form. It fills a hidden field with a token.
From your server, post that token to /api/v1/verify with the secret key. Accept the form when the answer is ok: true.

Step 3 from a terminal:

curl -X POST https://bot403.com/api/v1/verify \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"solution": "<the _bot403 field from the form>"}'

Protect your forms in minutes.

Quickstart
Create a site, add the script, check the token. By hand or with your AI assistant.
Browser setup
A quick guide to set up your frontend.
Verify on your server
Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby examples, and every failure reason.
MCP server
Connect Claude, Codex, Cursor or ChatGPT and let it set up Bot403 for you.
API reference
The challenge, verify, stats and sites endpoints and the OpenAPI file.
Script options
Attributes, the JavaScript API, timing, and Content Security Policy.
How the proof of work works
What the browser solves, difficulty levels, what it does not do.
Compare
Bot403 next to reCAPTCHA and Turnstile: price, cookies, privacy and setup.
JavaScript packages
@bot403/node verifies tokens on your server; @bot403/browser and @bot403/react get them in the browser. Typed, no dependencies.

The shortest possible version

index.html

<script src="https://bot403.com/v1/bot403.js" data-bot403-key="pk_live_YOUR_PUBLIC_KEY" async></script>
<form action="/contact" method="POST">…</form>

The script adds a hidden _bot403 field to every form. Your server posts that field to /api/v1/verify with the secret key and gets ok: true or a reason. Continue with the quickstart.