- How do I install captchaapi/laravel in a Laravel app?
- Run composer require captchaapi/laravel, then publish the config with php artisan vendor:publish --tag=captchaapi-config. Add CAPTCHAAPI_SITE_KEY and CAPTCHAAPI_SECRET_KEY to your .env file; the site key is public and the secret stays server-side. Place the x-captchaapi::widget component in your layout head and add the data-captcha attribute to the form you want protected. Finally, add the ValidCaptcha rule to the relevant form request or controller validation.
- Which Laravel and PHP versions does captchaapi/laravel support?
- The package requires PHP 8.2 or newer and Laravel 12 or 13; Livewire 4 is optional and only needed for the trait and livewire-form component. Applications still on Laravel 10 or 11, or on PHP 8.1, cannot install it without upgrading the framework or runtime first. That version gate is a hard blocker in many enterprise environments, so confirm your stack before evaluating further.
- How does the Livewire trait for captchaapi work?
- The package ships a WithCaptcha trait that composes the ValidCaptcha rule into a validateWithCaptcha() helper, so Livewire components can validate the CAPTCHA token alongside their other rules in one call. A dedicated livewire-form Blade component wraps the widget for Livewire 4, avoiding manual script wiring. Because verification happens server-side on each request, the secret key never reaches the browser. No database table, queue job, or cache dependency is involved.
- Is captchaapi.eu GDPR compliant and where is data stored?
- The service is hosted on Hetzner in Nuremberg, Germany, and the package sets no cookies, performs no tracking, and does not use Google. Challenge tokens and verification calls are described as staying within the EU. You should still request a DPA, a sub-processor list, and a written statement of what is retained server-side and for how long before signing off. Legal review, not code, is typically the longest part of adoption.
- What configuration options does captchaapi/laravel expose?
- The published config covers enabled (a kill switch), fail_open, timeout, base_url, locale, and mode, including an event mode for non-Blade front ends. These settings are env-driven, so you can disable the CAPTCHA or repoint the verification endpoint without a deploy of new code. Rollback from an incident is effectively a single environment flag change.
- What happens if captchaapi.eu is down or slow?
- With fail_open set to true, which is the default, validation passes when the verification call fails or times out, keeping public forms usable during an outage. That default is sensible for contact and comment forms but is a security weakness for login, registration, or payment flows, where you should switch to fail closed. The timeout option bounds how long a request waits on the verify endpoint. Because base_url is configurable, you can repoint verification at a self-hosted endpoint if the vendor publishes the protocol.
- Is captchaapi/laravel compatible with Laravel Octane?
- Yes, the package documents its Octane semantics, and the SDK is stateless: no database schema, no queue jobs, no cache dependency, and no long-lived state between requests. That stateless shape is why the blast radius is small and why Swoole or RoadRunner deployments do not need special handling beyond the normal config caching steps. If you use Fortify or another flow that validates twice in one request, be aware of the per-request memo behaviour around single-use tokens.
- How do I test forms protected by captchaapi in Pest or PHPUnit?
- The package includes a test fake that is aware of single-use tokens, so you can simulate successful and failed verifications without hitting the network. That keeps your Pest or PHPUnit suite fast and deterministic, and lets you assert the validation error path. The project itself is tested with Pest, PHPStan level 8, and Rector, so the internals follow the same conventions you would use.
- Does it work in a SPA, with a strict CSP, or when JavaScript is blocked?
- For non-Blade front ends, mode=event emits a CustomEvent you can listen for instead of relying on a hidden input. The widget models states such as waiting, solving, and rate_limited, but graceful degradation when JavaScript is disabled, the script is blocked by an adblocker, or CSP rules reject it is not empirically documented, and in those cases no token is produced so validation will fail. Test your specific CSP and failure paths, and consider fail_open for public forms.
- How does proof-of-work CAPTCHA compare to reCAPTCHA, hCaptcha, or Turnstile?
- Proof-of-work challenges are invisible to healthy devices, carry no cookies or tracking, and keep verification in the EU, which is the main reason teams pick it over Google reCAPTCHA. The trade-off is a non-zero CPU and battery cost on throttled or low-end mobile devices, and no published efficacy data showing which bot classes it actually deters. The package is also very early stage, with a single star, no dependents, and no third-party write-ups, so weigh vendor viability, SLA, and a continuity plan for captchaapi.eu before committing to production.