PRODUCT TEST WORKSPACE

hCaptcha

Native hCaptcha token verification

HCAPTCHA

02 / REQUEST

Request preview

POST /api/validator/create.cgi

{
  "productCode" : "HCAPTCHA",
  "adapter" : {
    "websiteURL" : "https://example.com/register",
    "websiteKey" : "YOUR_WEBSITEKEY"
  }
}

03 / RESULT

Response example

EXAMPLE

Task ID —

{
  "code" : 0,
  "msg" : "Success",
  "data" : {
    "taskId" : "11111111-1111-4111-8111-111111111111",
    "productCode" : "HCAPTCHA",
    "state" : "SUCCEEDED",
    "solution" : {
      "gRecaptchaResponse" : "EXAMPLE_HCAPTCHA_TOKEN"
    }
  }
}

Illustrative response; not a live task result. Replace all request placeholders before submitting.

Solution fields are not documented yet. This example shows the response envelope only.

Read data.solution after state becomes SUCCEEDED. The solution fields depend on the product; other states may return an empty object.

04 / API REFERENCE

hCaptcha · API

For task creation and queries, send the API key in the apiKey HTTP header. JSON request bodies contain business parameters only.

Content-Type: application/json
apiKey: YOUR_API_KEY

Result and application

TOKEN

Use solution.gRecaptchaResponse (or token when returned) with h-captcha-response and the callback required by the same target hCaptcha integration. The field name gRecaptchaResponse does not make this a Google token. Keep challenge/session bindings and check expiry, target verification and business completion. A token is not a transferable replacement challenge/answer pair.

Conditional workflows

HTTP submission HTTP_SUBMIT
Apply a result in the browser BROWSER_RESULT

Requirements

Prefer the product-specific (native) CAPTCHA integration over generic GRID. Identify the actual product/version and read its schema/guide before choosing. Use HTTP_SUBMIT when the target supports it, otherwise BROWSER_RESULT when the browser can apply the native result. Image grids on screen do not by themselves mean the product is GRID. Collect real inputs; missing inputs are a blocker, not permission to guess.
Apply a native result through the matching target integration: fill the expected token response field/callback, or use the returned challenge identifier and proof/answer fields together where that product requires them. Preserve the target session and bindings. Do not mix old and new challenge fields, replace only a picture, or assume the solver issues an unrelated transferable challenge/answer pair.
Identify hCaptcha by its hcaptcha API/widget, not its visual resemblance to reCAPTCHA. Select enabled HCAPTCHA and inspect its schema. This initial native contract supports websiteURL and websiteKey only. Upstream MCP parameters are not automatically Nex Captcha parameters: rqdata/data, invisible, custom domain, userAgent and proxy inputs are not exposed here. If the target requires them, stop and report the missing capability; do not omit required context, guess fields, misuse IMPERVA/reCAPTCHA, or silently purchase GRID.
Collect fresh values from the same target/challenge. Respect product-specific hostname, action, challenge/session, IP, User-Agent and expiry requirements; these are not universally interchangeable. Apply returned cookies only to their matching domains.
Examples are placeholders, not runnable challenges. Documented result fields are not proof of target acceptance or a live availability test. Do not send unsupported fields.
SUCCEEDED means a solver result is available. Separately confirm that the target accepts the challenge and that the requested business operation completes. The solver cannot observe those two outcomes.

Input sources

Field	Input sources
`websiteURL`	Full URL of the target page containing the current hCaptcha widget; not the hcaptcha.com iframe URL.
`websiteKey`	Public hCaptcha sitekey from the current target widget data-sitekey or hcaptcha.render configuration. Never use a reCAPTCHA key or the account secret.

Request example

POST /api/validator/create.cgi · JSONC

{
  "productCode": "HCAPTCHA", // Product code matching the adapter parameters.
  "adapter": { // Product-specific parameter object.
    "websiteURL": "https://example.com/register", // Full URL of the target page containing the current hCaptcha widget; not the hcaptcha.com iframe URL.
    "websiteKey": "YOUR_WEBSITEKEY" // Public hCaptcha sitekey from the current target widget data-sitekey or hcaptcha.render configuration. Never use a reCAPTCHA key or the account secret.
  }
}

Request headers: apiKey: YOUR_API_KEY

Comments explain the fields. Copy produces valid JSON without comments.

Response example

POST /api/validator/query.cgi · JSONC

{
  "code": 0, // Business result code: 0 means success; other values indicate an error.
  "msg": "Success", // Result message; may be empty on success.
  "data": { // Response data; may be null on an error.
    "taskId": "11111111-1111-4111-8111-111111111111", // Task ID returned by task creation.
    "productCode": "HCAPTCHA", // Product code matching the adapter parameters.
    "state": "SUCCEEDED", // Task state: CREATED, SUBMITTING, PROCESSING, SUCCEEDED, FAILED or EXPIRED.
    "solution": { // Product answer when SUCCEEDED; empty while processing or on failure.
      "gRecaptchaResponse": "EXAMPLE_HCAPTCHA_TOKEN" // Verification token to submit to the target website.
    }
  }
}

Creating a task returns its ID and initial state. Query the result or use WebSocket to receive the completed answer shown below.

Solution fields are not documented yet. This example shows the response envelope only.

Request parameters

Field	Type	Required	Description
`productCode`	string	Yes	Product code matching the adapter parameters.
`adapter`	object	Yes	Product-specific parameter object.
`adapter.websiteURL`	string	Yes	Full URL of the target page containing the current hCaptcha widget; not the hcaptcha.com iframe URL.
`adapter.websiteKey`	string	Yes	Public hCaptcha sitekey from the current target widget data-sitekey or hcaptcha.render configuration. Never use a reCAPTCHA key or the account secret.

Response parameters

Field	Type	Description
`code`	integer	Business result code: 0 means success; other values indicate an error.
`msg`	string	Result message; may be empty on success.
`data`	object \| null	Response data; may be null on an error.
`data.taskId`	string	Task ID returned by task creation.
`data.productCode`	string	Product code matching the adapter parameters.
`data.state`	string	Task state: CREATED, SUBMITTING, PROCESSING, SUCCEEDED, FAILED or EXPIRED.
`data.solution`	object	Product answer when SUCCEEDED; empty while processing or on failure.
`data.failure`	object \| omitted	Public diagnosis for FAILED/EXPIRED only; no raw provider messages. Follow the failure handling guide.
`data.failure.code`	string	Failure code
`data.failure.nextAction`	string	Next action
`data.solution.gRecaptchaResponse`	string	Verification token to submit to the target website.

Responses

HTTP business responses contain code, msg and data; code 0 means success. WebSocket uses a separate message structure.

-1317: Invalid API key.
-1100 / -1101: Invalid or missing request parameters.
-1401: Insufficient balance. Add funds before creating a task.
-1400 / -1001: System or task creation error.

API documentation

hCaptcha

Create task

Request preview

Response example

hCaptcha · API

Request example

Response example

Request parameters

Response parameters

Responses