TrustComponent
NodeJS
TrustCaptcha · Bot protection

NodeJS CAPTCHA Integration

Add a Node.js CAPTCHA to your app in minutes. TrustCaptcha protects sign-ups, logins, contact forms and API requests, and your server verifies each check. Real users see no puzzle, data stays in the EU, and the setup is GDPR-compliant.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or pick an existing one. If you want to try TrustCaptcha first, every plan comes with a 14-day free trial.

The CAPTCHA overview page shows your site key and license key, and you create your API key there. Add your website’s domains to the authorized domains in the CAPTCHA security rules so they can use your CAPTCHA.

Start of the CAPTCHA creation form.
CAPTCHA security rules of a demo CAPTCHA.

2. Integrate the CAPTCHA widget into your frontend

Integrate the CAPTCHA widget into your website or app. The CAPTCHA widget guide in our documentation has step-by-step instructions.

Read the documentation

The CAPTCHA widget will then be displayed on your website or app:

CAPTCHA start

Pre-built frontend integrations
Our pre-built frontend integrations add the CAPTCHA widget to your website or application. If there is none for your frontend technology yet, your developers can integrate the widget themselves using our documentation or ask our support team for a pre-built integration.

Angular
Contact Form 7
Craft CMS
JavaScript
Joomla
JTL-Shop
Keycloak
Magento 2
React
Shopware 6
Svelte
TYPO3
Vue
Webflow
WordPress

3. Validate the CAPTCHA result in your backend

The following steps show how a NodeJS backend fetches the CAPTCHA verification result from our server and decides what to do with it. For the full instructions, read the CAPTCHA integration guide for NodeJS in our documentation.

Read the documentation

First, install our TrustCaptcha NodeJS dependency:

Install
bash
npm i @trustcomponent/trustcaptcha-nodejs

Fetch the verification result from our server with the verification token and your API key:

Fetch Result
TypeScript
// Retrieving the verification result
let verificationResult;
try {
  verificationResult = await TrustCaptcha.getVerificationResult("<your_api_key>", "<verification_token_from_your_client>");
} catch (error) {
  // Fetch verification result failed - handle error
}

Based on the verification result and your own requirements, decide how to proceed:

Handle Result
TypeScript
// Act on the verification result
if (!verificationResult.verificationPassed || verificationResult.score > 0.5) {
  // Verification failed or bot score > 0.5 - possible automated request
}

Need detailed information about the NodeJS CAPTCHA integration?
Our NodeJS CAPTCHA integration guide has the detailed instructions, and our CAPTCHA samples repository on GitHub has a complete integration example.

Other backend technology instead of NodeJS?
If you run something other than NodeJS on your server, or have several backends, pick a different integration here. If we have no pre-built integration for your backend technology yet, your developers can integrate the CAPTCHA verification themselves using our documentation or ask our support team for a pre-built integration.

.NET
Go
Groovy
Java
Kotlin
Node.js
PHP
Python
Ruby
Rust
Scala

4. Test your integration

TrustCaptcha is now active. Send a test request and check that it goes through.

CAPTCHA done

FAQs

Do I need a frontend for a Node.js CAPTCHA?
Yes. TrustCaptcha is solved in the user’s browser (website or app) via the CAPTCHA widget. After it’s solved, your frontend receives a verification token and sends it to your Node.js backend (for example in a form submit or an API request).
What does my Node.js backend need to validate a TrustCaptcha check?
Two things: your CAPTCHA API key (from your TrustCaptcha dashboard) and the verification token from the frontend. Your backend uses them to retrieve the verification result from TrustCaptcha.
How does the Node.js validation work in simple terms?
You install the TrustCaptcha Node.js package, then your backend calls one function to fetch the verification result. You don’t need to manually decode the token or build the REST call yourself. The library handles that and returns a structured result object.
How do I decide whether to accept or block a request?
Start with two fields: verificationPassed (yes/no) and score (0 to 1, where higher means higher bot risk). A common starting rule is: accept only if verificationPassed is true and score is 0.5 or below, but you can choose stricter or more tolerant thresholds, or use a multi-step flow (e.g., allow, extra verification, reject).
How long is the verification token valid, and can I fetch the result more than once?
By default, the verification token is single-use and valid for 15 minutes. On the Enterprise plan you can extend the validity and allow a limited number of retrievals.
Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-compliant, EU-hosted.

CAPTCHA start
CAPTCHA done
No puzzles for visitors
The check runs in the background while visitors type, so more people finish your forms instead of giving up.
GDPR-compliant
Hosted in the EU, no cookies, encrypted transmission and automatic data deletion. Every customer gets a Data Processing Agreement.
Multi-layer security
Adaptive proof-of-work and risk scoring stop abuse early, even when attack traffic spikes.
Full control
Set the sensitivity, keep allow and block lists and use geoblocking. You decide how strict the check is.

Protect your NodeJS application with TrustCaptcha in just a few steps!

  • EU-hosted & GDPR-compliant
  • No puzzles
  • Try free for 14 days
Get started Contact sales