NexloLabs Verification — Overview

NexloLabs Verification is a self-hostable SaaS CAPTCHA & human verification platform by NexloLabs, available at verify.nexlolabs.net. It protects forms and APIs from bots while keeping friction low for real users.

How it works

You register a site in the dashboard and receive a public site key and a secret site secret.
You drop one script tag and a <div> into your page. The widget renders automatically.
A user solves the challenge (or is verified invisibly). The widget receives a signed token.
Your backend sends the token + secret to POST /api/challenge/verify and receives a risk score (0 = bot, 1 = human). You decide what to do with it.

Your website                    verify.nexlolabs.net
+------------------+            +------------------------------+
|  Widget (JS)     |            |  POST /api/challenge/create  |
|  renders in <div>|  --------->|  returns challenge data      |
|  user solves     |            |                              |
|  gets token      |  --------->|  POST /api/challenge/solve   |
|                  |            |  returns signed token        |
+------------------+            +------------------------------+
|  Your backend    |            |  POST /api/challenge/verify  |
|  sends token     |  --------->|  returns { success, score }  |
+------------------+            +------------------------------+

Feature highlights

6 challenge types: checkbox, image selection, slider puzzle, math, character code and fully invisible verification.
Risk score for every token (0–1), so you can set your own acceptance threshold.
Behavioral analysis: mouse entropy, timing and interaction patterns are evaluated server-side.
No tracking: no third-party cookies, no cross-site fingerprinting, no personal data collected.
Replay protection: tokens are HMAC-signed, expire after 120 seconds and can only be redeemed once.
Domain whitelisting: a site key only works on hostnames you registered.
Full dashboard: statistics, verification history, API keys with scopes, user management and an admin area.

Stack

Layer	Technology
Backend	Node.js, Fastify, TypeScript, Prisma, PostgreSQL, Redis
Widget	Vanilla TypeScript, zero dependencies, esbuild
Dashboard	Next.js 15 (App Router), Tailwind CSS, lucide icons
Frontend	Next.js 15 landing page + this documentation
API SDK	TypeScript SDK published from the `api/` workspace
Ops	Docker Compose (API, PostgreSQL, Redis, Nginx, frontend)

Next steps

Integration guide — protect your first form.
Widget configuration — every option of the script tag.
API reference — all public endpoints.
Challenge types — decide which challenge fits your use case.
Error codes — what the API can answer and how to handle it.