A human check made of stickers.

Add it to your site

Two parts: the widget in your form, and one call from your server when the form comes in.

1. The widget

<form action="/signup" method="post">
  …your fields…
  <div class="mssgs-captcha" data-sitekey="mcs_…"></div>
  <button type="submit">Sign up</button>
</form>
<script src="https://mssgs-stickers.com/captcha/v1/widget.js" async defer></script>

When the visitor passes, the widget puts the token in a hidden field, mssgs-captcha-response, so it goes along with the form. The frame grows to hold the stickers and shrinks back when they are done.

2. Your server checks the token

curl https://mssgs-stickers.com/api/v1/captcha/siteverify \
  -d secret=mcx_… \
  -d response="$TOKEN_FROM_THE_FORM"

{
  "success": true,
  "challenge_ts": "2026-11-02T10:31:07Z",
  "hostname": "example.com",
  "mode": "multi",
  "rounds": 3,
  "solve_ms": 7420,
  "error-codes": []
}

Refuse the form unless success is true. The answer has the shape reCAPTCHA’s and Turnstile’s have, so code that reads those reads this too. Check hostname if one key serves several sites. Send remoteip as well and the answer says whether it is the address that passed (remoteip_match). The body may be a form or JSON.

const res = await fetch('https://mssgs-stickers.com/api/v1/captcha/siteverify', {
  method: 'POST',
  body: new URLSearchParams({
    secret: process.env.MSSGS_CAPTCHA_SECRET,
    response: req.body['mssgs-captcha-response'] || ''
  })
});
const result = await res.json();
if (!result.success) {
  return res.status(400).send('Please do the sticker check.');
}

$ch = curl_init('https://mssgs-stickers.com/api/v1/captcha/siteverify');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POSTFIELDS => http_build_query([
    'secret' => getenv('MSSGS_CAPTCHA_SECRET'),
    'response' => $_POST['mssgs-captcha-response'] ?? '',
  ]),
]);
$result = json_decode(curl_exec($ch), true);
if (empty($result['success'])) {
  http_response_code(400);
  exit('Please do the sticker check.');
}

r = requests.post(
    "https://mssgs-stickers.com/api/v1/captcha/siteverify",
    data={"secret": os.environ["MSSGS_CAPTCHA_SECRET"],
          "response": request.form.get("mssgs-captcha-response", "")},
    timeout=10,
)
if not r.json().get("success"):
    abort(400)

res, err := http.PostForm("https://mssgs-stickers.com/api/v1/captcha/siteverify", url.Values{
	"secret":   {os.Getenv("MSSGS_CAPTCHA_SECRET")},
	"response": {r.PostFormValue("mssgs-captcha-response")},
})
if err != nil {
	return err
}
defer res.Body.Close()
var result struct{ Success bool `json:"success"` }
if err := json.NewDecoder(res.Body).Decode(&result); err != nil || !result.Success {
	http.Error(w, "Please do the sticker check.", http.StatusBadRequest)
	return nil
}

Errors siteverify can give

The widget’s options

For pages that build their forms in script, load widget.js?render=explicit&onload=yourFunction and call mssgsCaptcha.render(element, {sitekey: 'mcs_…', callback: fn}), which gives back an id for mssgsCaptcha.reset(id), getResponse(id) and remove(id). The widget also fires mssgs-captcha:verified and mssgs-captcha:expired events on its div.

Settings, per key

Change them on the settings page with your secret, or from a script, with the secret as the bearer:

curl https://mssgs-stickers.com/api/v1/captcha/site \
  -H "Authorization: Bearer mcx_…"

curl -X PATCH https://mssgs-stickers.com/api/v1/captcha/site \
  -H "Authorization: Bearer mcx_…" \
  -H "Content-Type: application/json" \
  -d '{"mode": "anti_ai", "rounds": 2, "domains": ["example.com"]}'

curl -X POST https://mssgs-stickers.com/api/v1/captcha/site/secret \
  -H "Authorization: Bearer mcx_…"

GET answers with the key’s settings and its counts (checks begun, passed, wrong picks, tokens verified and refused). PATCH changes only what the body names. The last call makes a new secret and stops the old one at once.

Keys for your tests

Privacy

No cookies, no tracking, no ads, nothing for anyone else. The visitor’s address is used to count tries against abuse, in memory for at most a quarter of an hour, and is sealed into the token so siteverify can tell your server whether it matches; neither you nor anyone else can read it from the token. Nothing about the visitor is stored.

Motion and access

The stickers move: that is the point of the anti-AI check, and it helps in the others. The opening shuffle stands still for visitors who ask their device for reduced motion. Every sticker is a button, reachable by keyboard, and the widget says out loud what happened after each pick. A check of pictures leaves out people who cannot see them; for forms where that matters, pair the captcha with another way in.