About the service

VK Капча is a service that determines in real time whether an application user is a human. The service protects key interaction points with users — authorization, registration, API endpoints — from automated attacks. Such attacks include:

• mass registration of fake accounts;
• brute force password attacks;
• automated message submission via web forms;
• content scraping;
• application-layer DDoS attacks.

The service filters out bots and accurately verifies legitimate users with minimal user effort. The service infrastructure includes SDKs for web applications, iOS, and Android, as well as a backend API.

1. The user performs an action in the application.

2. The application frontend sends a request to execute this action to the backend.

3. The application backend checks whether a captcha needs to be shown for this request. If yes, the backend calls VK Капча API to create a captcha session.

4. The VK Капча service returns a link to launch the captcha widget on the application frontend.

5. The application backend sends the received link to the frontend.

6. The application frontend passes the link to VK Капча SDK to display the captcha widget to the user.

7. VK Капча SDK displays the captcha widget to the user.

8. The user passes the verification. During the captcha process, the service analyzes the user's behavior and evaluates the user trust level (trust score).

9. After successful captcha completion, VK Капча SDK returns a success-token to the frontend — a cryptographically secured token confirming that the user has passed the verification. If the user fails the captcha, an error is returned instead of the token.

10. The application frontend sends a repeated request to the backend to execute the user action, containing the success-token.

11. The application backend sends the success-token to VK Капча API for verification.

12. The VK Капча service confirms the token validity.

13. The application backend processes the original user action and sends the result to the frontend.

14. The user is shown the result of the action execution.

Three captcha types are available in the VK Капча service:

• Checkbox — one-click verification. Minimal interaction, suitable for most scenarios.
• Slider — a visual task on an image grid that requires human perception and logic.
• Audio (sound) — an audio task: listen to an audio track and enter the recognized word.

The captcha type can be specified when creating a captcha session, or it can be selected automatically based on the user trust level assessment.

With automatic captcha selection, if the service evaluates the user as trusted, a checkbox captcha will be offered. Otherwise, the service escalates the difficulty and offers a slider captcha or an audio captcha.

The VK Капча service determines the user trust level in real time by combining several groups of signals:

• Behavioral signals.

  ML models analyze user behavior: cursor trajectories, click patterns, reaction speed, chronology and sequence of actions. Based on this data, a digital user profile (fingerprint) is formed, which persists between sessions. Bots imitating humans leave distinctive attributes that the ML model recognizes.

• Intensity and environment signals.

  The service examines the intensity of user request transmission and the execution environment on the user's side: device characteristics, browser configuration, available APIs. By analyzing the received data, the service identifies automated environments: headless browsers, emulators, virtual machine farms.

The final trust level assessment determines the captcha type that the user needs to pass.

Supported browsers:

• Google Chrome version 52 and above;
• Microsoft Edge version 79 and above;
• Firefox version 57 and above;
• Safari version 11 and above;
• Opera version 39 and above;
• Yandex Browser version 16.9 and above.

iOS:

• iOS version 12 and above;
• Xcode version 16.2 and above;
• Swift Package Manager version 5.9 and above;
• CocoaPods version 1.13 and above.

Android:

• Android version 5.0 (API 21) and above;
• Java version 11 and above;
• Kotlin version 1.9.0 and above.