loading…
loading…
Fetch a math question from our API. Display it with the challenge token.
GET https://mathcha.riskylaw.workers.dev/?generate&type=mixed&difficulty=medium
Collect the answer and POST to our API with the challenge token.
POST https://mathcha.riskylaw.workers.dev/
{ "session": "ch_xxx", "answer": 42 }
On your server, check the verified token before processing.
POST https://mathcha.riskylaw.workers.dev/
{ "action": "check", "token": "mc_verified_..." }
challenge token → solve →
verified token (proof).
Tokens expire after 5 min, single‑use.
POST /check
{ "token": "mc_verified_..." }
→ { "valid": true }
🛡️ only trust server‑side validation.
Generate a challenge, let the user solve it, then POST the answer to our API. If correct, we return a mc_verified_ token.
Both challenge and verified tokens expire after 2 minutes. They are single‑use and deleted after verification.
Yes, per IP: 15 challenge generations per minute, 15 answer verifications per minute, and 60 token checks per minute. Exceeding these returns a 429 error.
Yes! Call our API from your frontend to get the challenge, and validate the token on your server using the action: "check" endpoint.
The API returns { "success": false }. You can let them retry by generating a new challenge.