diff --git a/vault/app/api/auth/captcha/route.ts b/vault/app/api/auth/captcha/route.ts
new file mode 100644
index 0000000..3eafbe1
--- /dev/null
+++ b/vault/app/api/auth/captcha/route.ts
@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { createCaptchaChallenge } from "@/lib/server-security";
+import { jsonError } from "@/lib/server-api";
+import { isRateLimited } from "@/lib/server-rate-limit";
+
+export async function GET(request: Request) {
+  if (await isRateLimited(request, "captcha", 60, 60_000)) {
+    return jsonError("Too many captcha requests. Try again shortly.", 429);
+  }
+
+  const challenge = await createCaptchaChallenge();
+  return NextResponse.json({ challenge });
+}