Stop bots.
Without your
users notice.

// Client-side validation — useful in SPAs before submitting to your backend.
// For real protection, ALWAYS verify on your server too.
async function mcaptcha(token) {
    const url = 'https://medel.es/api/captcha/verify?token=' + encodeURIComponent(token);
    const data = await fetch(url).then(r => r.json());
    return data.ok === true;
}

// Usage in a form:
document.querySelector('form').addEventListener('submit', async (e) => {
    e.preventDefault();
    const fd = new FormData(e.target);
    const token = fd.get('mcaptcha_token');

    if (!(await mcaptcha(token))) {
        alert('Captcha failed');
        return;
    }

    // ✅ Captcha verified. Submit to your backend.
    await fetch('/api/contact', { method: 'POST', body: fd });
});

async function mcaptcha(token) {
    const url = 'https://medel.es/api/captcha/verify?token=' + encodeURIComponent(token);
    const data = await fetch(url).then(r => r.json());
    return data.ok === true;
}

// Usage (Express):
const token = req.body.mcaptcha_token;

if (!(await mcaptcha(token))) {
    return res.status(400).send('Captcha failed');
}

// ✅ Captcha verified. Process the form.

import urllib.request, urllib.parse, json

def mcaptcha(token):
    url = 'https://medel.es/api/captcha/verify?' + urllib.parse.urlencode({'token': token})
    with urllib.request.urlopen(url, timeout=5) as r:
        return json.loads(r.read()).get('ok') is True

# Usage (Flask):
token = request.form.get('mcaptcha_token', '')

if not mcaptcha(token):
    abort(400, 'Captcha failed')

# ✅ Captcha verified. Process the form.

# You only need a GET with the token as a query param:
curl 'https://medel.es/api/captcha/verify?token=YOUR_TOKEN'

# OK:   {"ok":true,"verified_at":"2026-06-22 12:24:56"}
# FAIL: {"ok":false,"error":"already_used"}