GateCHA

Self-hosted ALTCHA CAPTCHA management with API keys, multi-site support, and statistics.

🌐 Website · 📖 Documentation · 🧩 WordPress plugin

[!IMPORTANT] GateCHA has moved to the gatecha-org organization. Releases after v0.13.3 are published as ghcr.io/gatecha-org/gatecha only. ghcr.io/upellift99/gatecha stopped at v0.13.3 and receives no further updates: replace the image name in your docker-compose.yml or docker run command. Old github.com/Upellift99/GateCHA links redirect automatically.

GateCHA is a free, open-source alternative to ALTCHA Sentinel, ALTCHA's commercial self-hosted server. It wraps the ALTCHA proof-of-work CAPTCHA protocol with a management layer: API key management, per-site configuration, replay protection, and a dashboard with statistics. GateCHA is not affiliated with ALTCHA.

Features

• ALTCHA-compatible - Works with the official ALTCHA widget (MIT)
• API Key Management - Create keys per site with custom difficulty, TTL, and domain restrictions (multiple domains + *.example.com wildcards)
• Replay Protection - Consumed challenges are tracked and rejected on reuse
• Statistics Dashboard - Track challenges issued, verifications (success/fail), per key, per day
• MCP Endpoint - Manage API keys from an AI client (Cursor, Claude Code) over an authenticated MCP server; off by default
• Single Binary - Vue.js dashboard embedded in the Go binary via go:embed
• Multi-Database - SQLite by default; MySQL available in the mysql build variant
• Docker Ready - One container, zero external dependencies (SQLite mode)
• Lightweight - ~23.8MB Docker image, ~14.2MB binary (SQLite); ~24.2MB / ~14.5MB with MySQL support

Quick Start

Docker Compose (recommended)

mkdir -p /opt/docker/GateCHA && cd /opt/docker/GateCHA
wget https://raw.githubusercontent.com/gatecha-org/gatecha/refs/heads/main/docker-compose.yml
docker compose up -d

Open http://localhost:8080 and log in with admin / changeme.

Docker Run

docker run -d -p 8080:8080 \
  -v gatecha_data:/app/data \
  -e GATECHA_ADMIN_PASSWORD=your-password \
  ghcr.io/gatecha-org/gatecha:latest

Image tags

Tag	Points to	Use it when
latest	Newest published release	Default choice
0.3.3, 0.3	That exact release / newest patch in the 0.3 line	You want reproducible upgrades
main	Latest commit on main, unreleased	Testing an unreleased fix
sha-<commit>	One specific build	Pinning or bisecting

Pin 0.3 (or a full version) in production if you'd rather approve minor upgrades yourself, since latest crosses minor versions as they ship.

Every tag has a -mysql counterpart (latest-mysql, 0.3-mysql, main-mysql, …) built with MySQL support. All images are published for linux/amd64 and linux/arm64.

Prebuilt binary (no Docker)

GateCHA ships as a single self-contained binary with the web dashboard embedded, so there are no extra files or runtime dependencies. Grab the archive for your platform from the latest release (linux/darwin/windows, amd64/arm64):

# Example: Linux x86_64. Check the releases page for the current version
VERSION=0.3.0
curl -fsSL -o gatecha.tar.gz \
  "https://github.com/gatecha-org/gatecha/releases/download/v${VERSION}/gatecha_${VERSION}_linux_amd64.tar.gz"
tar -xzf gatecha.tar.gz
GATECHA_ADMIN_PASSWORD=your-password ./gatecha

Open http://localhost:8080. See Configuration for all options.

From Source

# Prerequisites: Go 1.26+, Node.js 20+
git clone https://github.com/gatecha-org/gatecha.git
cd GateCHA
make build        # SQLite only (default)
make build-mysql  # with MySQL support
./gatecha

Usage

1. Create an API Key

Log in to the dashboard at http://localhost:8080, go to API Keys, and create a new key.

2. Add the Widget to Your Site

<script async defer src="https://cdn.jsdelivr.net/npm/altcha/dist/altcha.min.js" type="module"></script>

<form action="/your-endpoint" method="POST">
  <!-- your form fields -->
  <altcha-widget
    challenge="https://your-gatecha-host/api/v1/challenge?apiKey=gk_your_key_id"
  ></altcha-widget>
  <button type="submit">Submit</button>
</form>

3. Verify on Your Backend

# Example: Python
import requests

altcha_payload = request.form.get('altcha')
resp = requests.post(
    'https://your-gatecha-host/api/v1/verify?apiKey=gk_your_key_id',
    json={'payload': altcha_payload}
)
if resp.json().get('ok'):
    # Valid submission
    pass

4. Optional: collect interaction signals (HIS)

Alongside the proof of work, GateCHA can score how a visitor interacted with the page: pointer travel, scroll and touch counts, typing rhythm and timings. This is the Human Interaction Signature (HIS). It records aggregates only, never coordinates, timestamps, key contents or field values.

Load the collector your own instance serves:

<script src="https://your-gatecha-host/api/public/his.js" defer></script>

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗