Integrations / Laravel
Middleware, Blade component, facade and validation rule — captchacore/laravel registers via auto-discovery and protects routes or individual forms.
In three steps
Add the repository, composer require — the service provider is discovered automatically.
Site key, secret and widget options as environment variables — no configuration in code.
<x-captchacore /> in the form, middleware on the route or rule in the FormRequest. That is all.
composer require captchacore/laravel
# .env
CAPTCHACORE_SITE_KEY=cc_pub_…
CAPTCHACORE_SECRET_KEY=cc_sec_…
// Route schützen
Route::post('/register', RegisterController::class)
->middleware('captchacore');
// oder als Validation-Rule
'captchacore_token' => ['required', new CaptchaCoreToken('contact')],What you get
Protects whole routes or groups — the token is verified before the controller runs.
<x-captchacore /> renders the widget and hidden token field, mode and theme via attributes.
For FormRequests: the token is validated like any other field, with a clean error message.
CaptchaCore::verify($token) for everything that does not fit into a form — APIs, Livewire, Inertia.
Whether to let through or block during an outage is your decision in the config.
Every API call has a timeout (default 3 s); errors go to the Laravel log, never to the end user.
Proof of work and behavioural analysis instead of traffic lights and crosswalks — humans click once, bots compute themselves to death.
Processing on our own servers, no transfer to third countries, no cross-site tracking.
The widget loads fast, never blocks the interface and works with keyboard and screen readers.
Yes. The widget attaches the token to the form; for SPA forms you fetch it via the JavaScript API and verify it with the facade.
The service offers a debug endpoint, and the facade can be faked in tests — your suite needs no network connection.
Laravel 10 to 13 with PHP 8.1 or newer.
All details, options and code examples: Documentation →
More integrations