captcha.eval8.ai is the human-verification service of the eval8 platform. Redirect users here before any sensitive action — they pass three challenges backed by behavioral bot detection, and return to your site with a one-time token your backend can trust.
Keyboard and scripted activation are physically impossible. Cursor trajectory is analyzed for human motion.
Distorted characters generated and validated entirely server-side, with keystroke-dynamics analysis while you type.
Hold a button until the bar fills — the duration is randomized per session and enforced on the server clock. Release timing exposes scripts.
Your site sends the user to /challenge with your public site key and a whitelisted return URL.
The user completes the three challenges while behavioral signals are scored server-side.
The user comes back to your site carrying a single-use eval8-token valid for 5 minutes.
Your backend posts its secret key + token to /api/siteverify and gets a definitive yes/no.
# 1. Send the user to the challenge page GET /challenge?site_key=eval8-xxx&redirect_uri=https://yoursite.com/resume&state=abc # 2. They come back to you as https://yoursite.com/resume?captcha_token=eval8-token-xxx&state=abc # 3. Confirm from your backend (never from the browser) POST /api/siteverify { "secret": "eval8-secret-xxx", "token": "eval8-token-xxx" } # → { "success": true, "challenge_ts": "…", "hostname": "yoursite.com" }