Security & Data Retention

How to keep your API key safe, and exactly what CaptchaKings stores when you solve a captcha.

Protecting Your API Key

Send the key in a header — Authorization: Bearer YOUR_API_KEY or X-API-Key: YOUR_API_KEY. Header-based auth keeps keys out of URLs, proxy logs, and browser history. (api_key as a POST field is also accepted on /api/process.php for legacy clients.)
Never embed the key in client-side code (browser JavaScript, mobile apps). Route solves through your backend.
Rotate keys from the dashboard if a key may have leaked. Old keys can be revoked without downtime for your integration.
HTTPS only. All API endpoints are served over TLS; do not send keys over plain HTTP.

What Happens to Your Captcha Images

Data	Stored?	Details
Captcha image content	No	Images are processed transiently in the solve pipeline and are not written to permanent storage on our servers.
Solve result (prediction text)	Yes	Kept in request logs so `res.php` can return it and for debugging/billing audits.
Request metadata	Yes	Request type, processing time, IP address, and user agent — used for billing records, abuse prevention, and the published benchmarks.
API key	Yes (hashed/secured)	Stored in your account record; never returned by any endpoint.

Input Validation

/api/process.php enforces at the boundary:

Accepted formats: JPG, PNG, GIF (WebP input is converted server-side before processing).
Maximum upload size: 5 MB.
Authentication required on every request; invalid or inactive keys are rejected with HTTP 400.

Acceptable Use

CaptchaKings may only be used to solve captchas on systems you own or are explicitly authorized to access. Prohibited uses include credential stuffing, spam, scraping in violation of a site's terms, and any activity unlawful in your jurisdiction. Full terms: Terms of Service.

Reporting a Security Issue

Found a vulnerability? Email [email protected] with details. We investigate all reports and credit responsible disclosure.

Related: Authentication · Error Handling