Feature overview

How it works

The intelligent verification service implements captchas using the following workflow.

1. Integrate the intelligent verification code into your application's client (web page) and server, then call the component on the relevant pages.

   Note

   • When integrating the intelligent verification code, ensure the appkey and scene parameter values match your configuration in the console and are consistent between the client and server.

   • When testing different front-end styles, you can use the test parameters (appkey and scene) provided in the front-end integration documentation. After testing, you must revert to your original appkey and scene parameter values. Do not use the test parameters in a production environment.

2. A user clicks the intelligent verification button on the client (web page). This triggers the intelligent verification component, which automatically sends a verification request to an Alibaba Cloud server to validate the user's action.

3. The Alibaba Cloud server uses risk control technology to validate the verification request and returns the result to the application client.

   The possible results are as follows:

   • Passes without a challenge: The smartCaptcha object automatically triggers its success callback, returning the result (the signature verification parameters).

   • Fails directly: The client displays a failure message and prompts the user to click the intelligent verification button again.

   • Requires secondary verification: If the initial check fails, the client automatically initiates a secondary verification, such as sliding verification.

   Note

   The green section of the diagram illustrates the complete workflow for secondary verification.

   3a. When secondary verification is triggered, the user follows the on-screen prompts to slide the slider to the end.

   3b. The Alibaba Cloud server uses risk control technology to validate the verification request and returns the result to the application client.

   • Success: Similar to a direct pass, the system triggers the success callback, which returns an equivalent result (the signature verification parameters).

   • Failure: The client displays a failure message and prompts the user to attempt the sliding verification again.

4. The client sends the signature verification parameters (param) and the business request (for example, a login or registration request) to your application server.

   Note

   The parameters required for signature verification include NVC_Opt.token, data.csessionid, and data.sig. We recommend that you also send the appkey and scene parameter values from the intelligent verification configuration to your application server. This allows the server to support multiple captcha configurations for different scenarios.

5. Your application server calls the afs signature verification API to validate the signature.

   Note

   For Java, .NET, PHP, and Python, you can use the provided Software Development Kit (SDK) to call the pre-packaged signature verification method. For other languages, you can call the signature verification API directly over HTTP.

6. The Alibaba Cloud server receives the signature verification request and validates the signature in real time.

   Note

   • To prevent malicious actors from collecting sig values for batch attacks, the signature verification parameters are valid for only 10 minutes.

   • A signature verification request succeeds only on its first use.

7. Your application server receives the signature verification result and processes it based on your business logic.

   • A code of 100 indicates that signature verification was successful.

   • A code of 900 indicates that signature verification failed.

8. The application client receives the final verification result and continues the business workflow.

Quick start

Use the following steps to integrate the intelligent verification service into your business.

Note

The intelligent verification service supports only PC web and H5 (mobile WAP and in-app) business types. If you want to deploy a captcha in a native mobile app, you can use the Captcha 2.0 service. For more information, see What is Captcha 2.0?.

1. Log in to the Alibaba Cloud Captcha console, and on the Error Code page, select the Configuration Management tab.

   The page displays a list of your existing configurations with columns such as Configuration name, Scenario, Verification method, Business type, and Last updated. To add a new verification configuration, click Add configuration in the upper-right corner. The Actions column provides links to Customize style and System code integration.

2. Click Add configuration.

   Note

   If you have already created a configuration for this business scenario, you can reuse it and its integration code.

   Set the Configuration name, Peak QPS, Scenario, and Business type. For Verification method, select Intelligent verification.

   Note

   Peak QPS is the number of page visits per second during your business's peak hours.

   

3. Click Next.

   Note

   Once you create a configuration, the system writes it to the production environment. The configuration cannot be modified or deleted, so configure these settings carefully.

4. On the System code integration & test page, securely save the automatically generated client-side and server-side integration code.

5. Integrate the client-side code into your client and the server-side code into your server.

Once the integration is complete, you can use intelligent verification to add captchas to your application.

More features

After integrating the intelligent verification service into your business, you can also use the following features:

• Customize style: Click Customize style on the Configuration management tab in the Alibaba Cloud Captcha console to customize the style of the front-end component. For details, see Customize the front-end style.

• Data monitoring: View monitoring data on the Data monitoring tab in the Alibaba Cloud Captcha console. For more information, see View data monitoring.