Protect a Next.js form from bots, without a puzzle

# .env.local: never in the repository, never prefixed with NEXT_PUBLIC_.
ANTISY_SITE_KEY=VOTRE_CLE_DE_SITE
ANTISY_SECRET=VOTRE_SECRET_DE_VERIFICATION

// app/layout.tsx
import type { ReactNode } from "react";

export default function RootLayout({ children }: { children: ReactNode }) {
  return (
    <html lang="fr">
      <head>
        {/* The site key is public: it goes in the page. The secret, never. */}
        <script src="https://api.antisy.com/v1/i/l.js" data-site={process.env.ANTISY_SITE_KEY} defer />
      </head>
      <body>{children}</body>
    </html>
  );
}

// app/contact/page.tsx: an ordinary HTML form, with no state and no JavaScript on your side.
export default function ContactPage() {
  return (
    <form method="post" action="/api/contact">
      <label>
        Nom <input name="name" autoComplete="name" />
      </label>
      <label>
        E-mail <input name="email" type="email" autoComplete="email" />
      </label>
      <label>
        Message <textarea name="message" />
      </label>
      <button>Envoyer</button>
    </form>
  );
}

// antisy.mjs: Node 22 or later, no dependency.
// Returns "allow" or "deny".
// Antisy does not answer (network, deadline, 5xx): "allow". Everything else that is uncertain: "deny".

// The 429 is a decision that is yours. "allow" by default, as for an outage;
// for a sensitive form, set "deny" (see the page on verification).
const ON_RATE_LIMIT = "allow";

export async function antisyVerdict(token) {
  // 1. A token that is there must have the shape of a token: 1 to 2048 printable ASCII characters.
  //    Otherwise, Antisy is not called and nothing is let through.
  //    An empty or missing field (script blocked) is sent as an empty string: Antisy reads it as a missing token.
  if (token && !/^[\x20-\x7e]{1,2048}$/.test(token)) {
    console.warn("Jeton mal formé, envoi non vérifié");
    return "deny";
  }

  let response;
  try {
    response = await fetch("https://api.antisy.com/v1/siteverify", {
      method: "POST",
      // fetch follows redirects by default: a 3xx would replay the body, secret included, elsewhere.
      // Here it is an error of your call (refused below).
      redirect: "manual",
      // A URLSearchParams body is sent as application/x-www-form-urlencoded.
      body: new URLSearchParams({
        secret: process.env.ANTISY_SECRET, // your secret, never in the page
        response: token ?? "",             // the antisy-token field, as received
      }),
      signal: AbortSignal.timeout(3000),   // beyond 3 s, Antisy does not answer
    });
  } catch (error) {
    console.warn("Antisy injoignable, envoi laissé passer :", error.name);
    return "allow";
  }
  if (response.status >= 500) {
    console.warn("Antisy a répondu " + response.status + ", envoi laissé passer");
    return "allow";
  }
  if (response.status === 429) {
    console.warn("Antisy a répondu 429, décision : " + ON_RATE_LIMIT);
    return ON_RATE_LIMIT;
  }
  if (!response.ok) {
    // 400, 401, 413, 415...: the fault is in your call. To be fixed, never a pass.
    console.error("Antisy a refusé la requête (" + response.status + "), envoi non vérifié");
    return "deny";
  }
  const result = await response.json().catch(() => null);
  if (typeof result?.success !== "boolean") {
    console.error("Réponse d'Antisy illisible, envoi non vérifié");
    return "deny";
  }
  // A missing or refused secret is not an HTTP error: the response is a refusal, with a 200.
  const codes = result["error-codes"] ?? [];
  if (codes.includes("missing-input-secret") || codes.includes("invalid-input-secret")) {
    console.error("Antisy refuse le secret : " + codes.join(", "));
  }
  // success is the only acceptance: it is true if and only if verdict is "allow".
  return result.success ? "allow" : "deny";
}

// app/api/contact/route.ts
import { antisyVerdict } from "../../../lib/antisy.mjs";

export async function POST(request: Request) {
  const form = await request.formData();
  const token = form.get("antisy-token"); // a string, a file or nothing

  // Missing field (script blocked): empty string, Antisy decides. A file is not a token: refusal.
  const verdict = token === null || typeof token === "string" ? await antisyVerdict(token ?? "") : "deny";
  if (verdict === "deny") {
    return new Response("Envoi refusé.", { status: 403 }); // generic refusal, without saying why
  }

  // … save or send the message
  return new Response(null, { status: 303, headers: { Location: "/merci" } });
}

// app/layout.tsx: with a nonce-based CSP policy set by proxy.ts (middleware.ts before Next.js 16)
import { headers } from "next/headers";
import type { ReactNode } from "react";

export default async function RootLayout({ children }: { children: ReactNode }) {
  const nonce = (await headers()).get("x-nonce") ?? undefined;
  return (
    <html lang="fr">
      <head>
        <script src="https://api.antisy.com/v1/i/l.js" data-site={process.env.ANTISY_SITE_KEY} defer nonce={nonce} />
      </head>
      <body>{children}</body>
    </html>
  );
}

{
  "success": true,
  "verdict": "allow",
  "flags": [],
  "error-codes": [],
  "challenge_ts": "2026-09-24T10:00:00Z",
  "hostname": "shop.example",
  "action": "contact",
  "event_id": "evt_01J7X4M2Q9K8ZP3R5T6V7W8Y9A"
}