A CAPTCHA that charges bots, not people.

Obol asks the visitor's browser to do a small amount of cryptographic work before a form is accepted. A person never notices it. A spammer sending thousands of requests pays for every one. No image puzzles, no cookies, no tracking.

Proof of work

Dozens of small SHA-256 puzzles, solved on all CPU cores in about a second. Difficulty rises automatically for networks that hammer a site.

Nothing to track

No cookies, no storage, no fingerprinting, no third-party requests. Addresses are hashed with a daily-rotating key and never written to disk.

Accessible

Nothing to see, hear or drag. Works with keyboard and screen readers, honours reduced motion and high-contrast modes.

Drop-in

A reCAPTCHA-style siteverify endpoint, so most existing integrations only need a new URL and keys.

Integrate in two steps

1. Add the widget to your form

<script src="https://captcha.example.com/widget.js" async defer></script>

<form method="post" action="/signup">
  …
  <obol-widget data-sitekey="obk_your_site_key"></obol-widget>
  <button>Sign up</button>
</form>

Once solved, the form carries a hidden field obol-response.

2. Verify the token on your server

POST https://captcha.example.com/api/v1/siteverify
Content-Type: application/x-www-form-urlencoded

secret=obs_your_secret&response=<value of obol-response>

→ { "success": true, "hostname": "example.com", "challenge_ts": "…", "action": "", "error-codes": [] }

Tokens are single-use and expire after a few minutes. Always check success on the server; the widget alone proves nothing.