Server-Side Verification

Always verify the SilentShield nonce on your server. Client-side checks alone can be bypassed by bots.

Why Server-Side?

The widget runs in the browser and injects a nonce into forms. A bot could skip the widget and submit the form directly. Server-side verification ensures the nonce was legitimately issued and verified by SilentShield.

API Endpoint

Method

POST

URL

https://api.silentshield.io/api/v1/captcha/verify-nonce

Headers

X-Api-Key: YOUR_API_KEY Content-Type: application/json

Body

{ "nonce": "the-nonce-from-the-form" }

Response Format

{
  "ok": true,
  "verdict": "human",
  "confidence": 0.92,
  "requested_nonce": "..."
}

human

human — User is very likely human. Process the form.

suspicious

suspicious — the server rejected it (HTTP 403, `ok: false`). The verdict names the reason, not the decision: that was already made by your account’s threshold.

bot

bot — High confidence this is a bot. Reject the form.

Recommended Logic

The server has already applied your account’s threshold: a rejection arrives as HTTP 403 with `ok: false`. So check for a pass, not for `bot` — otherwise you let through every rejection issued as `suspicious`, and every response without a verdict (invalid key, quota exhausted).

if not ok or verdict != "human":
    reject the form (403)
else:
    process the form normally

Error Handling

If the SilentShield API is unreachable (timeout, 5xx error), decide on your strategy:

Fail Open

Fail open — Accept the form (better UX, less secure)

Fail Closed

Fail closed — Reject the form (more secure, worse UX)