diff --git a/functions/[[path]].js b/functions/[[path]].js
index 10d9c42..600bf62 100644
--- a/functions/[[path]].js
+++ b/functions/[[path]].js
@@ -5,11 +5,14 @@ export async function onRequest({request,env,next}){
   const u=new URL(request.url)
   if(u.pathname==='/api/create'&&request.method==='POST'){
     try{
-      let{url:t}=await request.json();t=n(t);if(!t)throw 0
+      let{url:t,token:k}=await request.json()
+      if(!k||!(await(await fetch('https://www.google.com/recaptcha/api/siteverify',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:`secret=${env.RECAPCHA_KEY}&response=${k}`})).json()).success)
+        return new Response('CAPTCHA failed',{status:403,headers:H})
+      t=n(t);if(!t)throw 0
       let s;do s=r();while(await env.EV.get(s))
       await env.EV.put(s,t)
       return new Response(JSON.stringify({slug:s,target:t,shortUrl:`${u.origin}/${s}`}),{headers:{'Content-Type':'application/json',...H}})
-    }catch(_){return new Response('Invalid URL',{status:400,headers:H})}
+    }catch(_){return new Response('Invalid request',{status:400,headers:H})}
   }
   const p=u.pathname.slice(1)
   if(p){const t=await env.EV.get(p);if(t)return Response.redirect(t,302)}