Migrating from reCAPTCHA, hCaptcha or Cloudflare Turnstile
PoL Gate uses the same integration pattern, so most sites change two lines in the page and one URL and one field name on the server.
1. Page: replace the script and the widget element
| Provider | Before | After |
|---|---|---|
| reCAPTCHA v2 | <script src="https://www.google.com/recaptcha/api.js" async defer></script> and <div class="g-recaptcha" data-sitekey="..."> |
<script src="https://cdn.heliusnetwork.app/pol/v1/gate.js" async defer></script> and <div class="pol-gate" data-sitekey="pk_..."> |
| hCaptcha | https://js.hcaptcha.com/1/api.js and class="h-captcha" |
same as above |
| Turnstile | https://challenges.cloudflare.com/turnstile/v0/api.js and class="cf-turnstile" |
same as above |
data-callback, data-expired-callback and data-error-callback work the same way.
2. Server: change the verify URL and the form field
| reCAPTCHA | PoL Gate | |
|---|---|---|
| Form field | g-recaptcha-response |
pol-token |
| Verify URL | https://www.google.com/recaptcha/api/siteverify |
https://api.heliusnetwork.app/v1/siteverify |
| Request | secret, response, remoteip |
the same |
| Success field | success |
success (plus human, unique, present) |
| Token reuse | single use, about 2 minutes | single use, 120 seconds |
reCAPTCHA v3 returns a score for how human the traffic looks. PoL instead reports whether its Liveness Engine accepted a live, hand-held motion check, so replace score >= 0.5 with success === true. PoL also returns uniqueness_confidence and unique (confidence at or above your site's threshold). Require unique === true only where duplicates cost you money (sign-up bonuses, rewards, votes): a brand-new device starts below the default threshold and becomes unique with history or a vouch.
3. JavaScript API
| reCAPTCHA | PoL |
|---|---|
grecaptcha.render(el, opts) |
PoL.render(el, opts) |
grecaptcha.execute(sitekey, { action }) |
PoL.execute(sitekey, { action }) |
grecaptcha.getResponse(id) |
PoL.getResponse(id) |
grecaptcha.reset(id) |
PoL.reset(id) |
What users see
The first time, a 9-second motion challenge on their phone: three quick moves with the phone in the hand, then a confirmation with the phone's screen lock. Desktop users open the QR code on their phone. No camera, no documents and no biometrics are used by Proof-of-Life. After that, their Verified Human Pass is reused for 30 days, usually with a single screen-lock confirmation.
Recommended rollout
- Run PoL alongside your current CAPTCHA on one form and compare bot rates.
- Move high-value forms (sign-up, checkout, voting, rewards) to PoL first.
- Keep low-risk pages on an invisible check if friction matters more than certainty there.
Proof-of-Life is in early access. Request keys, read the API reference or the privacy notice.