CaptchaService is an open-source microservice that provides proof-of-work CAPTCHA challenges based on the ALTCHA library. It was developed by it@M, the IT service provider of the City of Munich, as the bot-protection layer in front of the city's public appointment services. On top of ALTCHA it adds adaptive difficulty per source address, multi-tenant support with separate keys and secrets for each site, IP and CIDR filtering, health checks and Prometheus metrics. The challenge flow runs on the client without cookies or tracking. The service is built with Java 21, Spring Boot and PostgreSQL and is distributed as a Maven artifact, with releases on GitHub.
The project is released under the MIT licence by the City of Munich's IT department (it-at-m) in Germany, so there is no commercial vendor and no foreign parent company. Organisations run it themselves on infrastructure of their choice, which keeps challenge data and verification fully under their own control. There is no vendor-hosted service: the organisation is responsible for operation, database and updates.