new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

captcha plugin

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Captcha plugin overview

The Captcha Plugin integrates bot protection into Better Auth by adding captcha verification for key endpoints. It ensures that only human users can perform actions like signing up, signing in, or resetting passwords.

Captcha provider support

The Captcha plugin supports four providers: Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, and CaptchaFox.

Captcha plugin installation

To install the Captcha plugin, import it from 'better-auth/plugins' and add it to the plugins array in the betterAuth config with the provider and secretKey options specified.

Captcha token in request headers

The captcha token should be added to request headers for all protected endpoints using the 'x-captcha-response' header. This is done through fetchOptions.headers in the client request.

Captcha plugin middleware flow

The Captcha plugin acts as middleware that intercepts POST requests to configured endpoints, validates the captcha token on the server by calling the captcha provider's /siteverify endpoint, and either returns an error if validation fails or returns undefined to allow the request to proceed.

Captcha plugin options reference

Plugin options for Captcha: provider (required, string) - the captcha provider; secretKey (required, string) - the provider's secret key for server-side validation; endpoints (optional, array) - replaces the default array of paths where captcha verification is enforced, default is ["/sign-up/email", "/sign-in/email", "/request-password-reset"]; minScore (optional, number, Google ReCAPTCHA v3 only) - minimum score threshold, default 0.5; siteKey (optional, string, hCaptcha and CaptchaFox only) - prevents tokens issued on one sitekey from being redeemed elsewhere; siteVerifyURLOverride (optional, string) - overrides endpoint URL for the captcha verification request.

Captcha default protected endpoints

By default, the Captcha plugin protects three endpoints: /sign-up/email, /sign-in/email, and /request-password-reset. Custom endpoints can be specified in the plugin options to override these defaults.

Captcha endpoint path matching

Paths in the endpoints option match exactly unless they include wildcards. Single segment wildcards use /path/*, and nested route wildcards use /path/**.

Captcha plugin email-password compatibility

The Captcha plugin works out of the box with Email & Password authentication. To use it with other authentication methods, configure the endpoints array in the plugin options.

Give your agent this brain