Skip to content
Logo

CAPTCHAs

Websites and APIs use CAPTCHAs and other bot checks to protect against fraud and abuse. An agent that acts for a real customer can still trigger these checks.

CAPTCHAs on Stripe

Stripe actively detects agents in Stripe payment flows through a variety of methods. These flows include Stripe-hosted pages, such as Checkout and hosted invoice pages, and payment forms that businesses build with Stripe Elements. Stripe’s risk systems use this information when they make decisions, such as whether to show a CAPTCHA.

To help Stripe recognize your agent and make the right decision:

  • Pay with Link Agent Wallet: Create a spend request, and pay with the credential that Link issues after the customer approves, such as a virtual card, instead of the customer’s own card details.
  • Use Link identity: Use the latest Link CLI version so that your agent benefits from Link’s active work on Link identity. On Stripe-hosted checkouts, pay with a Link Pay Token from your spend request.
  • Sign your requests with Web Bot Auth: Sign your agent’s HTTP requests as specified by the IETF Web Bot Auth working group. Publish your key directory and register your agent with bot-management providers. Stripe and some bot-management providers use these signatures as one input when they identify agents.
  • Don’t modify the browser: Run your agent in an unmodified browser. Changes to how the browser loads pages, scripts, or embedded frames can make Stripe’s security checks fail. Fraudsters make the same kinds of changes, so a failed check makes your agent more likely to see a CAPTCHA. If you use a browser automation provider, ask it to confirm that its browsers don’t change how pages and embedded frames load.

CAPTCHAs on other sites and services

Each business and service sets its own policy for agent traffic. Some block agents or show them CAPTCHAs, and Link can’t change those decisions.

Link identity and Web Bot Auth give a service a reliable way to recognize your agent, which can reduce friction:

  • Link identity: The service verifies that Link vouches for your agent, or that the customer’s email is verified, with the Agent Identity SDK.
  • Web Bot Auth: The service, or its bot-management provider, verifies which operator signed each request.

When you ask a business or service to allow your agent, point them to Identity and Verify credentials in your service.