Redeyed Sentinel CAPTCHA (Drupal 10/11)

Add friendly, privacy-respecting human verification to your Drupal login and registration forms with Redeyed Sentinel. This is a standalone module — it does not require the contrib CAPTCHA module.

Free to install. The module stays inert until you add your keys. With no keys the widget renders nothing and verification fails open, so your forms keep working while you get set up.

Install

1. Copy the redeyed_sentinel folder into your site's modules/custom/ directory:

   web/modules/custom/redeyed_sentinel/
   

   (Or require it with Composer if you publish it to a package repository.)

2. Enable the module:

   drush en redeyed_sentinel

   Or via the UI at Extend (/admin/modules).

Configure

Grab a Site Key and Secret Key from the Redeyed Lab: Sentinel → Sites. The Secret Key is shown only once, when you create the site — copy it then.

Go to Administration → Configuration → People → Redeyed Sentinel CAPTCHA (/admin/config/people/redeyed-captcha) and enter:

Field	Purpose
Site key	Public key that renders the widget. Safe to expose.
Secret key	Secret key used only for server-side verification. Keep private.
Base URL	Sentinel service URL. Defaults to https://redeyed.com.

Until both the site key and secret key are set the module is inert: nothing renders and verification passes automatically (fail open). Forms are never blocked by missing configuration.

Widget customization (optional)

Under Widget customization (optional) you can fine-tune how the widget looks and behaves. Every field is optional and backward-compatible — leave any of them empty to use the Sentinel widget defaults. When set, each renders as a data-* attribute on the sentinel-captcha div.

Field	Attribute	Purpose
Widget type	data-widget	adaptive (recommended), all (random), or a type: behavioral, pow, press_hold, text_math, image_puzzle, rotate_align, image_pick, relational_scene, motion_track, light_shadow, shape_match, count_match.
Theme	data-theme	auto, light or dark.
Colour scheme	data-scheme	Named colour scheme for the widget.
Difficulty	data-difficulty	Minimum challenge strength: easy, medium, hard, max (or 1–6).
Width	data-width	Widget container width, e.g. full, 100% or 340px.

Difficulty only raises challenge strength above the adaptive baseline. It never lowers it — Sentinel still escalates on its own when it sees risk, so a low difficulty will not weaken protection for suspicious traffic.

How it works

Step	Detail
Render	hook_form_alter() adds {base_url}/sentinel.js and a sentinel-captcha div (using your site key) to each enabled form — login, registration, password reset and contact.
Submit	The Sentinel widget injects a hidden sentinel-token field.
Verify	A validation handler POSTs to {base_url}/sentinel/siteverify via \Drupal::httpClient() with body {"secret": "...", "response": "...", "remoteip": "..."} (the remoteip is the client IP and is optional).
Pass	Only when the JSON response has top-level success === true (the response also carries outcome and score); otherwise the form shows "Human verification failed — please try again."

The secret key is sent only in the request body — never rendered to the page or written to logs. This is a reCAPTCHA/Turnstile-style flow: your site's own secret key authenticates the verify call, so no developer API key is required.

Requirements

• Drupal 10 or 11
• PHP 8.1+ (per Drupal core requirements)

Changelog

1.0.6

• Widget type, Theme and Colour scheme are now dropdowns, populated live from your Sentinel server via GET /captcha/capabilities. New challenge types and colour schemes appear automatically, with no module release.
• Premium colour schemes are labelled as paid-plan only. Previously you could type one on a free plan and it would silently render the default instead.
• Falls back to a built-in list (and says so) if the server cannot be reached, and a value you already saved stays selectable even if it is no longer offered.

1.0.5

• Widget type field now documents every challenge, including the new Object match 3D challenge (shape_match) and the relational_scene, motion_track and light_shadow reasoning challenges.
• Removed checkbox from the widget types — it was never a real Sentinel challenge and silently fell back to the site default. Use behavioral for the one-click checkbox, or adaptive to let Sentinel choose by risk.

1.0.4

• Per-form protection. Sentinel now guards the password reset (lost password) and contact forms in addition to login and registration, each with its own on/off checkbox under Protected forms. Login and registration stay enabled by default, so upgrades are non-breaking.
• Block log. Blocked attempts are recorded to Drupal's log (form, IP, outcome, score) — view them at Reports → Recent log messages, type redeyed_sentinel. Toggle with the Log blocked attempts checkbox.

1.0.3

• Added an optional Width setting that renders as data-width on the sentinel-captcha div only when set, e.g. full, 100% or 340px. Backward-compatible; leave it empty for the default.

License

MIT © 2026 Redeyed Corporation