Download the PHP package myra-security-gmbh/eu-captcha without Composer

On this page you can find all versions of the php package myra-security-gmbh/eu-captcha. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of myra-security-gmbh/eu-captcha

Informations about the package eu-captcha

EU-Captcha PHP client

Privacy-first, no-cookie, no-manual-interaction bot protection for PHP 8.0+ applications. Automatically filters bots, spam, and credential-stuffing attempts without requiring any user interaction.

Requirements

Installation

Note: This package requires PHP 8.0 or newer. Always install it with the ^2.0.1 constraint shown below (keep the quotes, so Windows cmd.exe does not drop the ^). The constraint excludes 2.0.0, which sends request fields the verification API rejects, so every validation fails. Without any constraint, Composer on PHP 5.x–7.x silently falls back to the legacy 1.x release, whose API (EU_Captcha class) does not match this README. On PHP 7.x or older, call the verification API directly instead.

Upgrading from 2.0.0? That release cannot verify tokens at all; see the changelog for what changed in 2.0.1. Run composer update myra-security-gmbh/eu-captcha so an existing lock file moves off 2.0.0.

Getting credentials

  1. Register at app.eu-captcha.eu
  2. Create a site and copy the sitekey and secret from the dashboard

Quick start

Using a SPA framework? The script tag and <div> approach below is for server-rendered pages. If you are building with React, Vue, or Angular, use the matching npm package for the frontend widget and continue to use this package for server-side verification only. See SPA integration guides for details.

Add the widget script to any page that contains a form you want to protect:

Place the widget inside your form:

Verify the submitted token on your server:

validate() reads the token automatically from the request body — $_POST['eu-captcha-response'], falling back to the body of a JSON request (application/json or a +json type such as application/vnd.api+json), where PHP leaves $_POST empty (e.g. Laravel or SPA clients) — and the client IP from server headers, so no extra wiring is needed in the common case. For full control (custom field names, or a framework-aware client IP such as Laravel's $request->ip()), pass the token and IP explicitly — see the Laravel section below.

Configuration options

All options are passed as named constructor arguments.

Option Type Default Description
sitekey string — Required. Public sitekey from the dashboard.
secret string — Required. Secret key from the dashboard. Never expose this client-side.
failDefault bool true Return value used for both network and token state when the API cannot be reached. true = fail open (allow on error); false = fail closed (deny on error).
checkCdnHeaders bool true When true, the client IP is resolved from CDN/proxy headers (HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_REAL_IP) before falling back to REMOTE_ADDR. Set to false when your server is not behind a proxy, or when you pass the IP explicitly.
verifyUrl string (production URL) Override the EU Captcha verify endpoint. Useful for testing.
credentialsUrl string (production URL) Override the EU Captcha verify-credentials endpoint.
client ?Client null Optional Guzzle client instance for custom configuration or testing.

The result object

validate() returns an EuCaptchaResult with three methods:

Method Returns true when…
success() The API was reached and the token is valid.
successNetwork() The API call completed without a network or transport error.
successToken() The API reported the submitted token as valid.

Checking both states separately lets you distinguish a user failing the captcha from an API outage:

Explicit token and IP

Pass the token and client IP explicitly when you need full control (e.g. non-standard form field names or API endpoints):

Verifying credentials

Use verifyCredentials() to confirm your sitekey and secret are valid without submitting a client token. This is useful for startup or configuration checks:

verifyCredentials() returns false on any network or API error rather than throwing, so it is safe to call during application initialisation.

Symfony

Type-hint EuCaptchaInterface in your services and controllers so Symfony can autowire the client without coupling your code to the concrete class.

Register EuCaptcha as a service and alias the interface to it in config/services.yaml:

Inject the interface into a controller:

$request->getClientIp() respects Symfony's trusted-proxy configuration, so the real visitor IP is forwarded correctly when running behind a CDN or load balancer. Pass the User-Agent as a third argument to validate() if you want to forward it to the API as well.

Laravel

Store credentials in .env and expose them through config/services.php — the Laravel convention for third-party credentials:

.env

config/services.php

Controller

$request->ip() respects Laravel's trusted-proxy configuration, so the real visitor IP is forwarded correctly when running behind a load balancer or CDN.

Form Request

For reusable validation across multiple controllers, add the CAPTCHA check to a dedicated FormRequest:

Inject ContactRequest instead of Request in your controller method — Laravel resolves and validates it automatically before the method body runs:

Further reading

License

BSD 2-Clause. See LICENSE for details.

All versions of eu-captcha with dependencies

PHP Build Version
Package Version
Requires php Version >=8.0
guzzlehttp/guzzle Version ^6.0 || ^7.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package myra-security-gmbh/eu-captcha contains the following files

Loading the files please wait ...