Ribaunt

Ribaunt is a stateless proof-of-work CAPTCHA library for Node.js and modern browsers. Your server issues challenges as signed JWTs, the browser widget solves the PoW puzzle, and your server verifies the submitted proof — all without touching a database. Drop it in front of any form, sign-up flow, or API endpoint to stop bots while keeping the experience smooth for real users.

Introduction

Learn what Ribaunt is, how proof-of-work CAPTCHA protects your app, and why stateless verification makes deployment simple.

Quickstart

Install Ribaunt, configure your secret, add two server endpoints, and embed the browser widget in under five minutes.

Server Setup

Full Express server example with challenge and verify endpoints, replay protection, context binding, and TypeScript types.

API Reference

Complete reference for createChallenge, verifySolution, solveChallenge, adaptive workload selection, and widget configuration.

Get up and running in four steps

Install Ribaunt

Add the package to your project with your preferred package manager.

npm install ribaunt

Set RIBAUNT_SECRET

Add a strong, randomly generated secret to your server environment. Ribaunt uses it to sign and verify JWT challenge tokens.

RIBAUNT_SECRET="replace-with-a-long-random-secret"

Add server endpoints

Create a GET /api/captcha/challenge endpoint that issues challenges and a POST /api/captcha/verify endpoint that validates solutions.

import { createChallenge, verifySolution } from 'ribaunt';

app.get('/api/captcha/challenge', (_req, res) => {
  const challenges = createChallenge({ difficulty: 5, amount: 4, ttlSeconds: 120 });
  res.json({ challenges });
});

app.post('/api/captcha/verify', async (req, res) => {
  const { tokens, solutions } = req.body;
  const result = await verifySolution(tokens, solutions);

  if (!result.valid) {
    return res.status(400).json({ success: false, error: result.reason, message: result.message });
  }

  return res.json({ success: true });
});

Drop in the widget

Add the web component to your HTML page. It fetches a challenge, solves it in the browser, and emits a verify event when done.

<script type="module" src="/node_modules/ribaunt/dist/widget-browser.js"></script>

<ribaunt-widget
  challenge-endpoint="/api/captcha/challenge"
  verify-endpoint="/api/captcha/verify"
  auto-verify="true"
></ribaunt-widget>

<script>
  document.querySelector('ribaunt-widget')
    .addEventListener('verify', (event) => {
      console.log('Verified!', event.detail.solutions);
    });
</script>

Get Started

Core Concepts

Server Setup

Frontend Integration

Widget

Guides

Introduction

Quickstart

Server Setup

API Reference

Get up and running in four steps

Introduction

Quickstart

Server Setup

API Reference

​Get up and running in four steps

Get up and running in four steps