Captcha service

Prerequisites

Android

iOS

H5

Add a captcha scheme

1. In the left-side navigation pane, choose Converged Authentication (based on atomic capabilities) > Captcha Service > Captcha Scheme Management.

2. Click Add Captcha Scheme.

3. Configure the scheme parameters on the page.

   • Scheme name: Enter a name for the new captcha scheme.

   • Client type: Select Android, iOS, or H5.

4. Click OK.

5. On the captcha scheme list page, click Key Parameters in the Actions column to obtain the appId, appKey, and other information.

Download and decompress the SDK

1. Log on to the Phone Number Verification Service console.

2. In the left-side navigation pane, choose Converged Authentication > Captcha Service > Learn about Captcha Service.

3. In the "Captcha Service integration steps" section on the page, click Download Now to go to the API&SDK page.

4. Download and decompress the appropriate SDK or JS file for your client. No download is required for the server side. On the API&SDK page, set Select Product Integration to Captcha, Select Client to APP or Web, and Select Platform to Android or iOS. Then, from Select Version, choose the required version (for example, Standard Edition 1.8.3) and click SDK Download (with demo).

Deployment and integration

Server-side

For server-side integration instructions, see Server-side integration.

Client-side

1. For Android integration instructions, see Android client-side integration.

2. For iOS integration instructions, see iOS client-side integration.

3. For Web or H5 integration instructions, see H5 client-side integration.

Product configuration and data viewing

Configure verification types

Captcha Service provides four verification types, listed in increasing order of security: click in order, click on text, nine-square grid verification, and click on icon. You can configure one or more interaction types on the Captcha Scheme Management page.

Captcha Service also provides anti-fraud protection and selection guidance:

• Captcha Service automatically monitors and blocks abnormal traffic. If a single IP address performs more than 100 verification attempts within one hour or exhibits other bulk-request behavior, the requests are blocked even if the answers are correct.

• For security-sensitive scenarios, we recommend choosing click on icon or nine-square grid verification. These two types rely more heavily on semantic recognition and provide stronger dynamic defense, which effectively blocks brute-force scripts and automated answer recognition by models. Experience-oriented types such as slider verification provide comparatively weaker protection.

• Captcha Service continuously updates the size and categories of its image library to further strengthen its anti-fraud capabilities.

View verification traffic data

1. On the Captcha Scheme Management page, click Authentication Traffic Chart in the Actions column.

2. On the Authentication Traffic Chart page, you can view data for the selected scenario, including the number of client-side verification attempts, successes and failures, and the volume of server-side secondary verification.

FAQ

How do I prevent bot traffic (anti-fraud) in one-click login or one-click registration scenarios?

Anti-fraud protection for one-click login and one-click registration cannot be enabled through console settings alone. You must integrate your code with Captcha Service to enable this protection. For the integration procedure, see Captcha service.

After I change the verification type in the console, do I need to modify my client-side code?

No. You do not need to modify your client-side code. Go to the Captcha Scheme Management page in the console, select the new verification type, and confirm the change. The new verification type takes effect immediately.

What happens if I select multiple verification types?

If you select multiple verification types, Captcha Service randomly presents one of the selected types to users during verification.

Does Captcha service support use outside mainland China, and does it provide global acceleration?

Yes. The captcha feature of Phone Number Verification Service supports use outside mainland China. Overseas cluster acceleration configurations have been added to ensure a smooth access experience for overseas users.

What do the ip_type and client_type parameters in the captcha verification response mean, and what values can they have?

• ip_type: The IP type resolved for the client that performed the verification. This is an auxiliary analysis field and does not affect the verification process. We do not recommend using it to restrict business logic. Valid values:

  Value	Description
  0	Unrecognized type
  1	Data center
  2	Dedicated egress
  3	Standard broadband
  4	Mobile broadband
  5	Media provider IP
  6	Crawler
  7	Small and medium-sized carrier

• client_type: The client type from which the verification request originated. Valid values: web, Android, iOS, and Harmony.