Bot403

Quickstart

Updated

With your AI assistant

Add the Bot403 MCP server to your assistant and ask it to protect your form. It signs you up, creates the site, adds the script tag and the server check. You only click the sign-in link in your email.

# Claude Code
claude mcp add --transport http bot403 https://bot403.com/mcp

# Codex
codex mcp add bot403 --url https://bot403.com/mcp

# Gemini CLI
gemini mcp add --transport http bot403 https://bot403.com/mcp

Then ask: "Protect the contact form in this project with Bot403." More clients and prompts are on the MCP page.

By hand

  1. Sign in and create a site. You get a public key (pk_live_…) and a secret key (sk_live_…).
  2. Put the script tag with the public key on every page that has a form: 
    <script src="https://bot403.com/v1/bot403.js" data-bot403-key="pk_live_YOUR_PUBLIC_KEY" async></script>
  3. On your server, post the _bot403 field to /api/v1/verify with the secret key. See more on the verify page.

The script adds two hidden fields to each form: _bot403 with the token and a honeypot field (default name _website). Your visitors never notice anything: the protection is invisible.

To try the two requests from a terminal: the script makes the first, your server makes the second.

curl "https://bot403.com/api/v1/challenge?pk=pk_live_YOUR_PUBLIC_KEY"
curl -X POST https://bot403.com/api/v1/verify \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"solution": "<the _bot403 field from the form>"}'

Optional: restrict origins

By default every origin can request challenges for your public key. On the site's settings page you can whitelist the allowed hostnames; the challenge endpoint then returns 403 to other hostnames.

What you see in the dashboard

The site page shows challenges issued, tokens solved, verifications by result, the top origins and the last 50 verifications. The first challenge appears there within 2 seconds.

Next: browser setup for fetch() and React, or how the proof of work works.