<script src="https://tac.ptab.cn/sdk/tac.js"></script>
<form id="loginForm" action="/api/login" method="post">
  <input name="account" autocomplete="username">
  <input name="password" type="password" autocomplete="current-password">
  <button type="submit">登录</button>
</form>

<script>
TacCaptcha.mount({
  appId: "your_app_id",
  apiBase: "https://tac.ptab.cn",
  type: "auto",
  trigger: "submit",
  form: "#loginForm",
  tokenField: "captchaToken"
});
</script>

// businessRequest 来自业务服务端持久化记录，不信任浏览器传来的摘要。
// scene 必须与取题一致；启用 serverHmac 后使用完整 v2 签名示例。
const res = await fetch("https://tac.ptab.cn/api/v1/captcha/second-verify", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-App-Id": process.env.TAC_APP_ID,
    "X-App-Secret": process.env.TAC_APP_SECRET
  },
  body: JSON.stringify({
    token: captchaToken,
    scene: businessRequest.scene,
    businessRequestId: businessRequest.id,
    businessDigest: businessRequest.digest
  })
});

const ret = await res.json();
if (!res.ok || ret.code !== 200) throw new Error("captcha failed");
// ret.data.replayed 为 true 时返回已有成功回执；业务本身仍需幂等提交。

curl -X POST https://tac.ptab.cn/api/v1/captcha/second-verify \
  -H "Content-Type: application/json" \
  -H "X-App-Id: $TAC_APP_ID" \
  -H "X-App-Secret: $TAC_APP_SECRET" \
  --data "$TAC_SECOND_VERIFY_JSON"

环境变量 TAC_SECOND_VERIFY_JSON 包含 token、scene、businessRequestId 和 businessDigest。仅在可信服务端调试；不适用于已强制 serverHmac 的应用。

<tac-captcha
  proxy-base="https://你的业务域名.com"
  scene="login"
  type="auto"
  bind:success="onTacSuccess"
  bind:fail="onTacFail" />

Page({
  onTacSuccess(e) {
    wx.request({
      url: "https://你的业务域名.com/api/login",
      method: "POST",
      data: { captchaToken: e.detail.token }
    });
  }
});

const canonical = [
  method.toUpperCase(),
  path,
  JSON.stringify(body || ""),
  nonce,
  timestamp
].join("|");

const signature = crypto
  .createHmac("sha256", process.env.TAC_APP_SECRET)
  .update(canonical)
  .digest("base64url");

上述旧 canonical 保持兼容，仅配合 v1 或 hmac 版本头使用；新 v2 的 bodyHash 与 canonical不同。密钥仅放服务端代理。

val captcha = ArcveilCaptcha(this)
val session = CaptchaSession.fromJson(sessionJson)
captcha.show(session) { result ->
    if (result.status == CaptchaResult.Status.VERIFIED) {
        // 异步提交自己的业务后端，二验通过后才放行
        submitToOwnBackend(session.sessionToken,
            result.token, businessRequestId)
    } else {
        showResult(result.code)
    }
}

ArcveilCaptcha captcha = new ArcveilCaptcha(this);
CaptchaSession session = CaptchaSession.fromJson(sessionJson);
captcha.show(session, result -> {
    if (result.status == CaptchaResult.Status.VERIFIED) {
        submitToOwnBackend(session.sessionToken,
            result.token, businessRequestId);
    } else {
        showResult(result.code);
    }
});

const crypto = require("crypto");

function canonicalPayload(method, path, body, nonce, timestamp) {
  return [
    String(method || "POST").toUpperCase(),
    path,
    JSON.stringify(body || ""),
    nonce,
    timestamp
  ].join("|");
}

function sign(method, path, timestamp, nonce, body, secret) {
  return crypto
    .createHmac("sha256", secret)
    .update(canonicalPayload(method, path, body, nonce, timestamp))
    .digest("base64url");
}

{
  "event": "captcha.verified",
  "appId": "tac_xxxxx",
  "scene": "login",
  "captchaType": "SLIDER",
  "riskLevel": "low",
  "ip": "203.0.113.10",
  "createdAt": "2026-06-15T00:00:00.000Z"
}