> ## Documentation Index
> Fetch the complete documentation index at: https://captcha.ribaunt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Welcome!

> Learn what Ribaunt is, how proof-of-work CAPTCHA protects your forms and APIs, and what makes Ribaunt stateless and easy to integrate.

Ribaunt is a stateless proof-of-work CAPTCHA library for Node.js and modern browsers. Instead of relying on a central database or third-party service to track challenge state, Ribaunt encodes everything your server needs directly into a signed JWT. Your server issues challenges, the browser solves them, and verification happens with a simple signature check — no external storage required. It's built for developers who want reliable bot protection without the operational overhead of managing shared state.

## How it works

The flow has three steps: your server creates a signed JWT challenge, the browser widget runs a proof-of-work computation to produce a valid nonce, and your server re-verifies the signature and the nonce before accepting any action. Because the challenge payload is self-contained and signed with your `RIBAUNT_SECRET`, the server can verify it at any time without persisting anything between requests.

For a deeper look at the cryptographic details and replay protection strategies, see the [How it works](/concepts/how-it-works) page.

## Key features

<CardGroup cols={2}>
  <Card title="Stateless" icon="database">
    Challenges are signed JWTs — no database, cache, or shared session store needed to issue or verify them.
  </Card>

  <Card title="Browser widget" icon="window">
    A built-in Web Component works with plain HTML. A React wrapper (`ribaunt/widget-react`) integrates with React and Next.js.
  </Card>

  <Card title="Replay protection" icon="shield-check">
    Local (process-level) replay protection is on by default. For serverless or multi-instance deployments, plug in a Redis/Valkey store.
  </Card>

  <Card title="Fully typed" icon="brackets-curly">
    Written in TypeScript with full type declarations included. No `@types` package needed.
  </Card>

  <Card title="Configurable difficulty" icon="sliders">
    Tune `difficulty`, `amount`, and `ttlSeconds` per endpoint to balance security and user experience.
  </Card>

  <Card title="Themeable" icon="palette">
    Style the widget with CSS custom properties — match any design system without touching shadow DOM internals.
  </Card>
</CardGroup>

## Installation

Install Ribaunt from npm using your preferred package manager.

<CodeGroup>
  ```bash npm theme={null}
  npm install ribaunt
  ```

  ```bash yarn theme={null}
  yarn add ribaunt
  ```

  ```bash pnpm theme={null}
  pnpm add ribaunt
  ```
</CodeGroup>

<Note>
  Browser solving requires a secure context — use HTTPS in production or `http://localhost` during development. Loading the widget from a plain LAN address such as `http://192.168.x.x` will fail because the Web Crypto API is unavailable in non-secure contexts.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Set up your secret, create server endpoints, and add the widget to your page in under five minutes.
  </Card>

  <Card title="How it works" icon="magnifying-glass" href="/concepts/how-it-works">
    Understand the full proof-of-work flow, JWT challenge structure, and replay prevention in depth.
  </Card>
</CardGroup>