hCaptcha setup

hCaptcha protects public attendee registration from bots and spam.

Enabling it

Settings → Security → "Enforce hCaptcha on public registration". Requires platform-level configuration (admin-side):

• HCAPTCHA_ENABLED=1 in env
• HCAPTCHA_SITEKEY=<sitekey> in env
• HCAPTCHA_SECRET=<secret> in env

Setup hCaptcha

1. Create an account at hcaptcha.com (free tier ~1M requests/month).
2. Add a site - copy the sitekey and secret.
3. Paste them into the application env.
4. Restart the workers.

What the user sees

On the registration form - the hCaptcha widget (challenge). On success, a token is included in the POST. The backend verifies the token via the hCaptcha API.

Failure mode

If the token is invalid or missing - the form shows "CAPTCHA verification failed. Please try again."

Alternative: Cloudflare Turnstile

Support is planned - currently hCaptcha only. Turnstile will be available once a wrapper is added.

Dev mode

HCAPTCHA_ENABLED=0 - verify_token() returns True without calling the API. Enables local development.