Skip to content
SupaCloud Docs
Select themeSelect language

`GET /api/auth/captcha/challenge` — mint a fresh ALTCHA challenge for the widget. 400 "captcha not enabled" when no HMAC secret is configured (opt-in).

GET
/api/auth/captcha/challenge
curl --request GET \
  --url https://example.com/api/auth/captcha/challenge

Responses

Section titled “Responses”

200

Section titled “200”

A fresh ALTCHA challenge for the widget to solve

Media typeapplication/json

A server-issued ALTCHA challenge, serialized as the JSON the ALTCHA widget fetches and solves ({ algorithm, challenge, maxnumber, salt, signature }).

The widget brute-forces the integer n <= maxnumber whose sha256(salt || n) equals challenge, then resubmits the envelope plus that number — which AltchaVerifier::verify re-derives and checks against signature.

object
algorithm
required

The hash algorithm — always "SHA-256".

string
challenge
required

The lower-case hex SHA-256 digest the widget must reproduce.

string
maxnumber
required

The upper bound (inclusive) of the proof-of-work search space.

integer format: int64
salt
required

The server-issued salt, carrying the ?expires=<unix> suffix.

string
signature
required

The server’s HMAC signature over the challenge hex string.

string
Examplegenerated
{
  "algorithm": "example",
  "challenge": "example",
  "maxnumber": 1,
  "salt": "example",
  "signature": "example"
}

400

Section titled “400”

Captcha is not enabled on this instance

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited too_many_requests quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}