Server-Side Verification

Always verify the SilentShield nonce on your server. Client-side checks alone can be bypassed by bots.

Why Server-Side?

The widget runs in the browser and injects a nonce into forms. A bot could skip the widget and submit the form directly. Server-side verification ensures the nonce was legitimately issued and verified by SilentShield.

API Endpoint

Method: POST
URL: https://api.silentshield.io/api/v1/captcha/verify-nonce
Headers: X-Api-Key: YOUR_API_KEY Content-Type: application/json
Body: { "nonce": "the-nonce-from-the-form" }

Response Format

Responsejson

{
  "ok": true,
  "verdict": "human",
  "confidence": 0.92,
  "requested_nonce": "..."
}

human: human — User is very likely human. Process the form.
suspicious: suspicious — the server rejected it (HTTP 403, `ok: false`). The verdict names the reason, not the decision: that was already made by your account’s threshold.
bot: bot — High confidence this is a bot. Reject the form.

Recommended Logic

The server has already applied your account’s threshold: a rejection arrives as HTTP 403 with `ok: false`. So check for a pass, not for `bot` — otherwise you let through every rejection issued as `suspicious`, and every response without a verdict (invalid key, quota exhausted).

Server-Side Logicjavascript

if not ok or verdict != "human":
    reject the form (403)
else:
    process the form normally

Forms sent with AJAX

The widget reports a submission when the form is sent with a regular submit. It also reports requests made with XMLHttpRequest, including jQuery.ajax, as long as the request body contains the behavior_nonce field: it holds the request for a moment, reports the typing and mouse data and sends the request once the verdict is in, after 15 seconds at the latest. So serialise the whole form, hidden fields included. Your server-side check does not change.

Not covered: requests made with fetch() and synchronous requests. For these the server receives no typing and mouse data and /v1/verify answers suspicious.

Error Handling

If the SilentShield API is unreachable (timeout, 5xx error), decide on your strategy:

Fail Open: Fail open — Accept the form (better UX, less secure)
Fail Closed: Fail closed — Reject the form (more secure, worse UX)

For most applications, we recommend fail open with logging. Critical forms (login, payment) should fail closed.