Mathcha is a simple CAPTCHA verification API that protects your website from bots by requiring users to complete a math challenge before continuing.
It works like other CAPTCHA services: your website gets a challenge, the user completes it, and your backend receives proof that the challenge was completed successfully.
Your website requests a CAPTCHA from Mathcha. Mathcha creates a question and temporary token.
The user solves the math question shown on your website.
Mathcha checks the answer and creates a verified token.
Your backend validates the verified token before allowing the user action.
Mathcha uses two types of tokens.
daefaf39-0b13-46e5-98a6-69ea0e6270dd
This token represents an active CAPTCHA challenge. It is used only while the user is solving the question.
mc_verified_8f92d7d4-xxxx
This token proves the user successfully passed the CAPTCHA. Your backend uses this token.
Waiting...
Waiting...
Waiting...
Your website displays the CAPTCHA and collects the answer.
GET
https://mathcha.riskylaw.workers.dev/?generate&type=mixed&difficulty=medium
Response:
{
"question":"8 × 7 = ?",
"session":"challenge_token"
}
After the user answers:
POST
{
"session":"challenge_token",
"answer":56
}
If correct:
{
"success":true,
"token":"mc_verified_token"
}
Your backend should never trust the browser. The browser can be modified by users. Instead, your server checks the Mathcha token.
User submits form:
{
"username":"Alex",
"captcha_token":"mc_verified_token"
}
Your backend sends:
POST Mathcha API
{
"action":"check",
"token":"mc_verified_token"
}
Mathcha replies:
{
"valid":true
}
If valid is true, your backend can continue.
if(valid){
createAccount();
}
else{
rejectRequest();
}
Operations: plus minus times divide mixed Difficulty: easy medium hard impossible mixed