Challenge

Keys

Read the Botpoison Challenge docs page "Keys" at https://botpoison.com/documentation/challenge/keys.md
and use it to make this change in my project.
Use the stack this project already runs on, and ask me for my keys rather than inventing them.

Every Challenge configuration has two keys: a public key for your page and a secret key for your server. Find both on the configuration's Settings tab in the dashboard.

Public key

The public key starts with pk_. It sits in your page's markup or JavaScript, where anyone can read it. It can only request a challenge for its configuration. It never changes, so published pages keep working.

Secret key

The secret key starts with sk_. Your server sends it to /verify with each solution. Keep it in your server's environment, never in client code, a public repository or a log line.

Send it as an Authorization: Bearer header, an X-Api-Key header, or as secretKey in the body. If you send more than one, the body key wins, then the bearer token. See the REST API.

Rerolling the secret key

Reroll the secret key when it may have leaked, or when someone with access leaves. The public key, the settings and the history stay the same.

Open the configuration in the dashboard and go to its Settings tab.
Choose Reroll key and confirm.
Copy the new secret key into your server's environment.
Deploy, then submit your form once to check that it verifies.
Revoke the old key under Previous key, or let it run out on its own.

The old key keeps working for 1 hour

After a reroll, /verify accepts both keys for 1 hour, so you can deploy the new one without a gap. Then it rejects the old key with Invalid secret key. If the key leaked, revoke the old one as soon as the new one is live: a revoked key is refused at once. Reroll again within the hour and only the key you just replaced keeps working; the one before it stops at once.

Test key

In development, use the secret key test. See Challenge test mode for the solutions that force each result.