Verifying Tokens Server-Side

Never trust a widget token on its own — always confirm it from your backend with a server-to-server call to POST /sentinel/siteverify. This is reCAPTCHA/Turnstile-style: your site's Secret Key authenticates the call, so no developer API key is needed.

The request

Submit your secret (the site's Secret Key) and the response token your form collected (optionally remoteip). The endpoint accepts JSON or form-encoded input.

curl -X POST https://redeyed.com/sentinel/siteverify \
  -d "secret=st_sec_xxxxxxxxxxxx&response=sentinel-token-from-widget&remoteip=203.0.113.42"

Reading the outcome

{
  "success": true,
  "outcome": "passed",
  "score": 18,
  "reason": "Acceptable risk (score 18)"
}