TrustCaptcha – Bot protection

Flask CAPTCHA Integration

Wire TrustCaptcha into a Flask view in just a few lines of Python. Stop bot-driven spam on logins, signups and contact forms — and reuse the verification across views with a small @verify_trust_captcha decorator. EU-hosted, GDPR-ready, no image puzzles.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or select an existing one. If you’re unsure whether TrustCaptcha is right for you, try our CAPTCHA service risk-free for 14 days at no cost.

On the CAPTCHA overview page, you will find all the important information, such as the site key and licence key, and you can also create your API key. Allow your websites to access your CAPTCHA by simply adding them to the access authorised domain list in the CAPTCHA security rules.

CAPTCHA security rules of a demo CAPTCHA.

2. Add the CAPTCHA widget to your Jinja template

Drop the TrustCaptcha widget into the Jinja form template your Flask view renders. The widget runs the CAPTCHA in the background and adds a hidden tc-verification-token field on submit, which arrives on request.form like any other input.

templates/contact.html

HTML

<script type="module" src="https://cdn.trustcomponent.com/trustcaptcha/3.0.x/trustcaptcha.esm.min.js"></script>

<form method="post" action="{{ url_for('submit') }}">
    <input type="email" name="email" required>
    <trustcaptcha-component sitekey="<your_site_key>"></trustcaptcha-component>
    <button type="submit">Send</button>
</form>

The CAPTCHA widget will then be displayed inside your form:

Need detailed information about the CAPTCHA widget integration?
For the full widget reference — including themes, languages, custom design and more — please read our documentation.

Read the documentation

3. Validate the token in your Flask view

In your Flask view, take the verification token from request.form, look up the result via our Python library, and decide whether to accept the request.

First, install our TrustCaptcha Python library:

Install

bash

pip install "trustcaptcha>=3.0.0,<4.0.0"

Then validate the token inside your Flask view and act on the result:

app.py

Python

from flask import Flask, request, render_template, redirect, url_for
from trustcaptcha.trust_captcha import TrustCaptcha

app = Flask(__name__)

@app.post("/contact")
def submit():
    token = request.form.get("tc-verification-token", "")

    try:
        trust_captcha = TrustCaptcha("<your_api_key>")
        result = trust_captcha.get_verification_result(token)
    except Exception:
        return render_template("contact.html", error="CAPTCHA verification failed."), 400

    if not result.verification_passed or result.score > 0.5:
        return render_template("contact.html", error="CAPTCHA verification failed."), 400

    # CAPTCHA passed — process the request
    return redirect(url_for("contact_success"))

Need detailed information about the Flask CAPTCHA integration?
For full step-by-step instructions — including a reusable @verify_trust_captcha decorator — please read our documentation.

Read the documentation

Other backend framework instead of Flask?
If you use a different framework, pick the matching recipe here. If your framework isn’t listed, your software developers can integrate the verification themselves using our documentation or ask our support team for a pre-built integration.

4. Congratulations 🎉

You are now protected by TrustCaptcha - congratulations!

FAQs

Where in a Flask app does the CAPTCHA verification go?

Inside the view function that handles the form submission, before you persist data or send any email. The CAPTCHA token comes in as a regular form field on request.form (default name: "tc-verification-token").

Can I run the CAPTCHA verification as a Flask decorator?

Yes — and that's the cleanest way once you protect more than one view. Build a small @verify_trust_captcha decorator that reads the token from request.form, calls our Python library and aborts with 400 on failure. You then add it to any view with a single line.

How do I share the SDK across my Flask app?

Build a single TrustCaptcha instance once at startup and store it on app.extensions["trust_captcha"]. Any view or decorator can read it via current_app.extensions["trust_captcha"] without re-initialising the library on every request.

Does TrustCaptcha work with Flask blueprints?

Yes. The verification has nothing blueprint-specific — register the decorator (or the view-level call) inside any blueprint and protect a single view, all views in a blueprint, or a particular URL prefix.

Where should I keep the CAPTCHA API key?

In an environment variable (e.g. TRUSTCAPTCHA_API_KEY), loaded via os.environ at startup. Never commit the key to your repo or hard-code it in a view function.

Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-ready, EU-hosted.

Puzzle-free UX

Runs in the background while visitors type — so more people finish your forms and fewer drop off.

GDPR-ready

EU-hosted and privacy-first: no cookies, encrypted transmission, automatic cleanup — with ready-to-use legal resources.

Multi-layer Security

Adaptive protection plus intelligent risk scoring stops abuse early — even when attack traffic spikes.

Full Control

Fine-tune sensitivity, set allow/block lists, and use geoblocking — you decide how strict verification should be.

Protect your Flask application with TrustCaptcha in just a few steps!

EU-hosted & GDPR-ready
No puzzles
Try free for 14 days

Get started Contact sales