TrustCaptcha · Bot protection

Go CAPTCHA Integration

Add a Go CAPTCHA to your backend in minutes: put the widget in your forms, verify requests in your Go API and act on the bot score. It stops signup, contact and checkout abuse without puzzles. EU-hosted and GDPR-compliant.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or pick an existing one. If you want to try TrustCaptcha first, every plan comes with a 14-day free trial.

The CAPTCHA overview page shows your site key and license key, and you create your API key there. Add your website’s domains to the authorized domains in the CAPTCHA security rules so they can use your CAPTCHA.

CAPTCHA security rules of a demo CAPTCHA.

2. Integrate the CAPTCHA widget into your frontend

Integrate the CAPTCHA widget into your website or app. The CAPTCHA widget guide in our documentation has step-by-step instructions.

Read the documentation

The CAPTCHA widget will then be displayed on your website or app:

Pre-built frontend integrations
Our pre-built frontend integrations add the CAPTCHA widget to your website or application. If there is none for your frontend technology yet, your developers can integrate the widget themselves using our documentation or ask our support team for a pre-built integration.

3. Validate the CAPTCHA result in your backend

The following steps show how a Go backend fetches the CAPTCHA verification result from our server and decides what to do with it. For the full instructions, read the CAPTCHA integration guide for Go in our documentation.

Read the documentation

First, install our TrustCaptcha Go module:

Install

bash

go get github.com/trustcomponent/trustcaptcha-go/v3

Fetch the verification result from our server with the verification token and your API key:

Fetch Result

// Retrieving the verification result
verificationResult, err := trustcaptcha.GetVerificationResult("<your_api_key>", "<verification_token_from_your_client>")
if err != nil {
  // Fetch verification result failed - handle error
  return
}

Based on the verification result and your own requirements, decide how to proceed:

Handle Result

// Act on the verification result
if !verificationResult.VerificationPassed || verificationResult.Score > 0.5 {
  // Verification failed or bot score > 0.5 - possible automated request
}

Need detailed information about the Go CAPTCHA integration?
Our Go CAPTCHA integration guide has the detailed instructions, and our CAPTCHA samples repository on GitHub has a complete integration example.

Other backend technology instead of Go?
If you run something other than Go on your server, or have several backends, pick a different integration here. If we have no pre-built integration for your backend technology yet, your developers can integrate the CAPTCHA verification themselves using our documentation or ask our support team for a pre-built integration.

4. Test your integration

TrustCaptcha is now active. Send a test request and check that it goes through.

FAQs

How does a Go CAPTCHA check work?

A Go CAPTCHA is a check your backend runs before it processes a request. The widget in the browser solves a proof-of-work task in the background, sends signals for the risk assessment and adds a verification token to the form. Your Go handler passes that token and your API key to trustcaptcha.GetVerificationResult and gets a pass or fail plus a bot score from 0 (very likely human) to 1 (very likely bot). You pick the threshold, so bot traffic on sign-ups, comments or checkout is stopped where it arrives.

Can I share one TrustCaptcha client across goroutines?

Yes. For custom settings, create a client once at startup with trustcaptcha.New(apiKey, options); the instance is immutable and safe for concurrent use, so every handler and goroutine can reuse it. It uses Go's net/http with default timeouts of 3 seconds to connect and 5 seconds to read, which you can change in the options. With the defaults, the package-level GetVerificationResult function is enough.

Does the Golang CAPTCHA module work with Gin, Echo and Fiber?

Yes. The module only needs the verification token from the request, so it works in plain net/http handlers and in any router or framework. Read the tc-verification-token field in your handler, fetch the result and return an error response if the check fails. Our Gin, Echo and Fiber guides show the code for each framework.

How should my Go handler react to errors?

GetVerificationResult returns typed errors such as VerificationTokenInvalidError, VerificationResultExpiredError or VerificationResultRetrievalLimitReachedError; treat those as a failed check. ServerUnreachableError means your server could not reach our API at all, and our documentation suggests allowing the request and logging the incident. ClientReportedServerUnreachableError means the widget reported an outage your server cannot confirm, so reject the request or ask for another check.

Is TrustCaptcha GDPR compliant?

TrustCaptcha is built for GDPR-compliant use: data is processed and stored exclusively in the EU on ISO 27001-certified infrastructure, no cookies are set, and you can sign the Data Processing Agreement online. Whether your use is compliant also depends on your setup and your privacy policy. This is not legal advice; check the details with your data protection officer.

Can I customize the look of TrustCaptcha in Go?

Yes, and none of it touches your Go backend, because the look is set on the widget in your frontend. You get 37+ languages ready to use, can add any other language and override every widget text, and can pick a light or dark theme or follow the system setting. From the Team plan you can adjust colors, borders and corner radius. A widget without our branding or a fully invisible widget is the paid Captcha Branding add-on.

How does TrustCaptcha stay accessible while blocking bots?

There are no image or audio puzzles: the widget runs a proof-of-work in the background and the bot score rates the request. The widget ships with ARIA labels and screen-reader text and is designed to meet WCAG standards and the European Accessibility Act. Bots pay in computing time, because the proof-of-work gets harder as the risk rises, and risky requests can still fail your bot score threshold.

Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-compliant, EU-hosted.

No puzzles for visitors

The check runs in the background while visitors type, so more people finish your forms instead of giving up.

GDPR-compliant

Hosted in the EU, no cookies, encrypted transmission and automatic data deletion. Every customer gets a Data Processing Agreement.

Multi-layer security

Adaptive proof-of-work and risk scoring stop abuse early, even when attack traffic spikes.

Full control

Set the sensitivity, keep allow and block lists and use geoblocking. You decide how strict the check is.

Protect your Go application with TrustCaptcha in just a few steps!

EU-hosted & GDPR-compliant
No puzzles
Try free for 14 days

Get started Contact sales