Modus
BOT_DETECTION_MODE live
HMAC key Configured (64 chars)
Missbrauchsschutz
Aktive Verteidigung gegen Missbrauch — Captcha, Honeypot, Rate-Limits, KI-Budget.
Konfiguration
Algorithm
PBKDF2/SHA-256Cost
100,000Challenge expiry
300sReplay store Upstash Redis
Replay key prefix
altcha:nonce:Replay TTL
10 minChallenge rate limit 30 per 60 s (per client IP)
Live-Demo
Solve the captcha below.
Geschützte Endpunkte
POST /api/auth/sign-in/magic-link— magic-link sendPOST /api/auth/email-otp/send-verification-otp— email OTP send
Enforcement happens in authCaptchaGate (a SvelteKit handler in hooks.server.ts) before the
request reaches Better Auth.
Geht dieses Pattern noch besser? Sag uns, wie.
Feedback geben