TrustCaptcha · Bot protection

Java CAPTCHA Integration

Add a Java CAPTCHA: verify TrustCaptcha tokens on the server and stop bot spam on logins, signups and forms. A short step-by-step guide with ready-made Java code gets you there. EU-hosted and GDPR-compliant, with no image puzzles.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or pick an existing one. If you want to try TrustCaptcha first, every plan comes with a 14-day free trial.

The CAPTCHA overview page shows your site key and license key, and you create your API key there. Add your website’s domains to the authorized domains in the CAPTCHA security rules so they can use your CAPTCHA.

CAPTCHA security rules of a demo CAPTCHA.

2. Integrate the CAPTCHA widget into your frontend

Integrate the CAPTCHA widget into your website or app. The CAPTCHA widget guide in our documentation has step-by-step instructions.

Read the documentation

The CAPTCHA widget will then be displayed on your website or app:

Pre-built frontend integrations
Our pre-built frontend integrations add the CAPTCHA widget to your website or application. If there is none for your frontend technology yet, your developers can integrate the widget themselves using our documentation or ask our support team for a pre-built integration.

3. Validate the CAPTCHA result in your backend

The following steps show how a Java backend fetches the CAPTCHA verification result from our server and decides what to do with it. For the full instructions, read the CAPTCHA integration guide for Java in our documentation.

Read the documentation

First, add our TrustCaptcha Java dependency:

Maven Central

XML

<dependency>
  <groupId>com.trustcomponent</groupId>
  <artifactId>trustcaptcha</artifactId>
  <version>3.0.0</version>
</dependency>

Fetch the verification result from our server with the verification token and your API key:

Fetch Result

Java

// Retrieving the verification result
VerificationResult verificationResult;
try {
  verificationResult = TrustCaptcha.getVerificationResult("<your_api_key>", "<verification_token_from_your_client>");
} catch (CaptchaFailureException e) {
  // Fetch verification result failed - handle error
}

Based on the verification result and your own requirements, decide how to proceed:

Handle Result

Java

// Act on the verification result
if (!verificationResult.isVerificationPassed() || verificationResult.getScore() > 0.5) {
  // Verification failed or bot score > 0.5 - possible automated request
}

Need detailed information about the Java CAPTCHA integration?
Our Java CAPTCHA integration guide has the detailed instructions, and our CAPTCHA samples repository on GitHub has a complete integration example.

Other backend technology instead of Java?
If you run something other than Java on your server, or have several backends, pick a different integration here. If we have no pre-built integration for your backend technology yet, your developers can integrate the CAPTCHA verification themselves using our documentation or ask our support team for a pre-built integration.

4. Test your integration

TrustCaptcha is now active. Send a test request and check that it goes through.

FAQs

Does a Java CAPTCHA need a frontend widget?

Yes. The Java part only validates a verification token that was created by the CAPTCHA widget in a website or app. Your frontend must display the widget, receive the verification token after solving, and send that token to your Java backend.

What do I need on my Java backend to validate a verification token?

You need (1) the verification token from your frontend request and (2) your API key (server-side only). Then your backend calls our verification API (typically via our Java library) and reads the result.

What does the Java verification result contain?

The result includes at least two key values: (1) verificationPassed (a clear pass/fail signal) and (2) botScore (a risk score from 0 = likely human to 1 = likely bot, from the Solo plan). You can use both to decide what to do next.

How should I make a decision based on verificationPassed and botScore?

Always check verificationPassed first. Then use botScore as your risk signal. A common starting point is a threshold of 0.5, and you can adjust it depending on how strict you want to be. You can also use different thresholds for different endpoints (for example, login stricter than a newsletter form).

What can I do if the result looks risky, instead of blocking immediately?

You can choose different actions based on your process: block the request, show an error message, require an extra step (like an additional verification), or accept the request but flag it internally as potential spam for later review.

How long is a verification token valid, and can I verify it multiple times?

By default, the verification token is single-use and valid for 15 minutes. On the Enterprise plan you can extend the validity and allow a limited number of retrievals.

Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-compliant, EU-hosted.

No puzzles for visitors

The check runs in the background while visitors type, so more people finish your forms instead of giving up.

GDPR-compliant

Hosted in the EU, no cookies, encrypted transmission and automatic data deletion. Every customer gets a Data Processing Agreement.

Multi-layer security

Adaptive proof-of-work and risk scoring stop abuse early, even when attack traffic spikes.

Full control

Set the sensitivity, keep allow and block lists and use geoblocking. You decide how strict the check is.

Protect your Java application with TrustCaptcha in just a few steps!

EU-hosted & GDPR-compliant
No puzzles
Try free for 14 days

Get started Contact sales