Enterprise

This page covers KEPCA's enterprise features: team management, custom domains, audit logging, and billing plans.

Team management

KEPCA supports multi-user organizations with role-based access control. A team (organization) can own multiple sites and share access across members.

Roles

Role	Sites	Settings	Billing	Members	Owner transfer
Owner	CRUD	CRUD	CRUD	CRUD	Yes
Admin	CRUD	CRUD	Read	CRU	No
Member	Read	Read	--	--	No
Viewer	Read	--	--	--	No

Creating a team

curl -X POST https://api.kepca.com/v1/teams \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corp",
    "slug": "acme-corp"
  }'

{
  "team_id": "team_abc123",
  "name": "Acme Corp",
  "slug": "acme-corp",
  "owner_id": "usr_abc123",
  "created_at": "2026-04-09T12:00:00.000Z"
}

Inviting members

curl -X POST https://api.kepca.com/v1/teams/team_abc123/invites \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "colleague@example.com",
    "role": "admin"
  }'

The invited user receives an email with a link to accept. Pending invites expire after 7 days.

Listing team members

curl https://api.kepca.com/v1/teams/team_abc123/members \
  -H "Authorization: Bearer <jwt>"

{
  "members": [
    {
      "user_id": "usr_abc123",
      "email": "owner@example.com",
      "name": "Ada Lovelace",
      "role": "owner",
      "joined_at": "2026-04-01T00:00:00.000Z"
    },
    {
      "user_id": "usr_def456",
      "email": "colleague@example.com",
      "name": "Grace Hopper",
      "role": "admin",
      "joined_at": "2026-04-05T00:00:00.000Z"
    }
  ]
}

Updating a member's role

curl -X PATCH https://api.kepca.com/v1/teams/team_abc123/members/usr_def456 \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "role": "member" }'

Removing a member

curl -X DELETE https://api.kepca.com/v1/teams/team_abc123/members/usr_def456 \
  -H "Authorization: Bearer <jwt>"

Custom domains (CNAME)

Enterprise plans can serve the KEPCA widget and API from a custom subdomain (e.g., captcha.yourdomain.com). This avoids ad-blocker interference and provides a branded experience.

Setup steps

1. Add the domain in the dashboard or API:

curl -X POST https://api.kepca.com/v1/domains \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "captcha.example.com",
    "site_key": "mpt_site_abc123"
  }'

Response:

{
  "domain_id": "dom_abc123",
  "domain": "captcha.example.com",
  "status": "pending_verification",
  "cname_target": "cname.kepca.com",
  "txt_record": "_kepca-verify.captcha.example.com",
  "txt_value": "kepca-verify=abc123xyz"
}

2. Add the DNS records with your DNS provider:

Type	Host	Value
CNAME	captcha.example.com	cname.kepca.com
TXT	_kepca-verify.captcha.example.com	kepca-verify=abc123xyz

3. Wait for verification. KEPCA checks DNS records every 5 minutes. Once verified, the status changes to active and TLS certificates are provisioned automatically.

4. Update your widget to use the custom domain:

<script src="https://captcha.example.com/v1/maptcha.js" defer></script>

<maptcha-widget
  data-sitekey="mpt_site_abc123"
  data-endpoint="https://captcha.example.com"
></maptcha-widget>

Listing domains

curl https://api.kepca.com/v1/domains \
  -H "Authorization: Bearer <jwt>"

Removing a domain

curl -X DELETE https://api.kepca.com/v1/domains/dom_abc123 \
  -H "Authorization: Bearer <jwt>"

Audit log

Every administrative action in KEPCA is recorded in an immutable audit log. The audit log is available on Pro and Enterprise plans.

What is logged

Action Category	Examples
Authentication	Login, logout, password change
Site management	Site created, settings changed, key rotated
Team management	Member invited, role changed, member removed
Domain management	Domain added, verified, removed
Webhook management	Webhook created, updated, deleted
Billing	Plan changed, payment method updated

Querying the audit log

curl "https://api.kepca.com/v1/audit?from=2026-04-01T00:00:00Z&limit=50" \
  -H "Authorization: Bearer <jwt>"

{
  "entries": [
    {
      "id": "aud_001",
      "timestamp": "2026-04-09T12:00:00.000Z",
      "actor": {
        "user_id": "usr_abc123",
        "email": "admin@example.com",
        "ip": "203.0.113.42"
      },
      "action": "site.settings_updated",
      "resource": {
        "type": "site",
        "id": "mpt_site_abc123"
      },
      "changes": {
        "mode": { "from": "adaptive", "to": "always-challenge" }
      }
    }
  ],
  "has_more": true,
  "cursor": "aud_001"
}

Query parameters

Param	Type	Default	Description
from	string	30d ago	Start time (ISO 8601)
to	string	now	End time (ISO 8601)
actor	string	--	Filter by user ID
action	string	--	Filter by action (e.g., site.*)
limit	number	50	Results per page (max 100)
cursor	string	--	Pagination cursor from previous page

Audit log entries are retained for 90 days on Pro and 1 year on Enterprise plans.

Billing plans

KEPCA offers three plans to match different usage levels.

Plan comparison

Feature	Free	Pro	Enterprise
Verifications/month	10,000	500,000	Unlimited
Sites	2	20	Unlimited
Challenge types	PoW, Checkbox	All 6	All 6
Team members	1	10	Unlimited
Custom domains	--	1	Unlimited
Audit log	--	90 days	1 year
Webhooks	--	5	Unlimited
Rate limits	Standard	Elevated	Custom
Support	Community	Email	Dedicated
SLA	--	99.9%	99.99%
Price	$0	$29/month	Custom

Checking current plan

curl https://api.kepca.com/v1/billing/plan \
  -H "Authorization: Bearer <jwt>"

{
  "plan": "pro",
  "status": "active",
  "current_period_start": "2026-04-01T00:00:00.000Z",
  "current_period_end": "2026-05-01T00:00:00.000Z"
}

Usage and limits

curl https://api.kepca.com/v1/billing/usage \
  -H "Authorization: Bearer <jwt>"

{
  "period": "2026-04",
  "verifications": {
    "used": 142500,
    "limit": 500000,
    "percentage": 28.5
  },
  "sites": {
    "used": 5,
    "limit": 20
  },
  "team_members": {
    "used": 4,
    "limit": 10
  }
}

Overage

On the Pro plan, if you exceed your monthly verification limit, additional verifications are billed at $0.50 per 10,000. You receive email alerts at 80% and 100% of your limit. On the Free plan, verifications are blocked once the limit is reached.

Helm chart

For Kubernetes deployments, KEPCA provides an official Helm chart.

Installation

helm repo add kepca https://charts.kepca.com
helm repo update

helm install kepca kepca/kepca \
  --namespace kepca \
  --create-namespace \
  --set postgresql.enabled=true \
  --set valkey.enabled=true \
  --set ingress.enabled=true \
  --set ingress.hostname=captcha.example.com

Key values

Value	Default	Description
replicaCount	2	Pods per service
postgresql.enabled	true	Deploy PostgreSQL subchart
valkey.enabled	true	Deploy Valkey (Redis) subchart
ingress.enabled	false	Create Ingress resource
ingress.hostname	""	Ingress hostname
ingress.tls	true	Enable TLS via cert-manager
metrics.enabled	true	Expose Prometheus metrics
autoscaling.enabled	false	Enable HPA
autoscaling.minReplicas	2	Minimum replicas
autoscaling.maxReplicas	10	Maximum replicas

See the full values.yaml reference in the infra/helm/kepca directory.

Next steps

• Security -- rate limiting, key rotation, and token verification
• Challenge Types -- all six challenge types with configuration
• REST API -- full endpoint reference