Fraud Defense (reCAPTCHA)

After following the docs here, I am getting the below erro

I'm using identity platform to log a user in with MFA. i'm using the javascript sdk and i can see the network request to v2/accounts/mfaSignIn:start fails with the error below. recaptcha seems to work fine and mfaSignIn:start includes the recaptcha token. an earlier call to v3/relyingparty/verifyPassword also works fine and uses the same API key and service. it just started happening today and has been on and off, so i don't think it's something on my end. Logs explorer in the Cloud Console doesn't show any more information about the error. The error is occuring across multiple projects and multiple organizations."The phone verification request contains an invalid application verifier. The reCAPTCHA token response is either invalid or expired."

Hi,My application is based on java 8 , grails 2.4.3, and postgresql. The java based application is using hibernate ORM and spring is embedded. I have a requirement of implementing google recaptcha enterprise version in the application. We do have google recaptcha implemented with the grails plugin mentioned here https://plugins.grails.org/plugin/iamthechad/recaptcha but same would not be applicable for enterprise version. Because the code inside the plugin  seems to be for non enterprise version. So with the project configuration available what all my option to implement the recaptcha. Any suggestion? Thank you in advance!

We have to migrate from the non enterprise version of recaptcha to enterprise one. What I can see in the documents is that the migration of keys can be carried out using a command. which looks good! however there is a page which says "Using reCAPTCHA Enterprise features after migration" and inside the page we have been asked to instrumenting the pages. But in the project we have integrated recaptcha (already a non enterprise version) I do not have them explicitly mentioned to be instrumented. like below file needs to be replaced by https://recaptchaenterprise.googleapis.com   https://www.google.com/recaptcha/api.js or any explicit call for any of the API mentioned below needs to be instrumented grecaptcha.execute() -> grecaptcha.enterprise.execute() grecaptcha.getResponse() -> grecapt

I'm trying to integrate google recaptcha entreprise in a next.js app, when I use a non test key, the returned token is always null, however it's returned fine when I use a test key. What is the problem please.Here is the github link for the repo: https://github.com/Seif-apprentus/Next-JS-Landing-Page-Starter-Template/blob/master/src/pages/login/index.tsx

Hello,I have implemented recaptcha for a web page with a form.When I run locally from file in my browser I got the token but the validation is saying browser error.When I host in Azure I always get a null token despite I have a * for CORS domain.Can you please help?I have tried both version 3 and enterprise.this is the snippet of the call with version 3:grecaptcha.ready(() => {              grecaptcha              .execute("reducted")              .then((token) => {Adding an action on the execute call does not change anythingThanksLuigi

I have a web page with Google reCaptchav3. It allows to input an ID number, click a button and requests from database some results. If a user input an ID number and click the button, then it generates one reCaptcha token.An ethical hacker is requesting a LIST of ID numbers with just one token and implies to me that I should program my web page in order to prevent that.How could I prevent or avoid in my web page that a bot or hacker input a list of ID numbers using only one token? Honestly, I thought that was Google reCaptcha job. Thanks. 

I have set up recaptcha verification in my android app. It runs smoothly on all android devices except for HarmonyOS 3.0.0 (should be a fork from Android 12 by Huawei).I am using the package com.google.android.recaptcha. In HarmonyOS, it returns an exception RecaptchaException: Key type invalid. I have confirmed from the google cloud console that the key is a valid android site key, and this key works perfectly on other android devices except for HarmonyOS.My users who use a Huawei device face this problem since Huawei installs HarmonyOS on all of its smartphones.The code and the error:The "About" page of the Huawei device:

Want to know which API we are using to fetch keys present for the below Query for the below table under findings  If i click on finding name i can see json response and in the json response there is one key " mitreAttack" Query : In which API response i can get this key and how is response gets populated for this key

Greetings!I'm experiencing an issue when signing up for reCAPTCHA Enterprise that is needed to implement reCAPTCHA on iOS app. I have  fillied up sign up form, but twice didn't received any answer. Nothing in AntiSPAM too. Thanks in advance for help.

Hi. We have been using reCaptcha enterprise on our site for years. 3 weeks back suddenly recpatcha started marking nearly every interaction as high risk. Its blocking almost all legitimate users from filling query forms on the website. What do we do about it?

Guys, I have no idea where I should put this questionLast month we received an e-mail telling us that our reCaptcha quota had been exceeded and we had 90 days to upgrade do Enterprise. Yesterday we received the second e-mail. In both e-mail we had over 1 million requests per month, and that number does not match our traffic volume. We use reCaptcha in our Azure AD B2C license. The url is similar to "https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/etc"  and all the other Azure AD B2C clients have their instances running in a URL similar to that "companyname.b2clogin.com/etc"This alert started when we implemented reCaptcha in our Registration form. We know that roughly 20k users get to this page monthly. We have the following questions before upgrading to Enterprise (because something seems to be wrong):1- what counts as a request for reCaptcha V2? If the widget is printed, the user interacts

My clients with slow internet connections have encountered issues with passing reCaptcha. The issue can be reproduced by throttling internet connection speed (for example, to 2G) and attempting to pass reCaptcha. Requests to the reCaptcha API are aborted after 5 seconds on slow connections. I have tried to find a way to override this 5-second abort, but there is no information about it in the reCaptcha documentation.I would like to know if there is any way to increase this 5-second abort or some other way to handle slow internet connections in this case?Reproducible on demo (https://www.google.com/recaptcha/api2/demo) by throttling download speed to 40kbits and upload speed to 10kbits.  

The example provided on reCAPTCHA Enterprise frictionless assessment, uses the following rule to detect an action on the login page and allows it:request.path.matches(\\"/login.html\\") && token.recaptcha_action.score >= 0.8However, is not clear if the request.path on the rule refers to a Front-End (website) route or a backend route. If it refers to the latter: What is needed to craft an equivalent rule for a GraphQL endpoint? on GraphQL there is a single path /graphql using always the POST method for all the actions.Would be the rule below enough?token.recaptcha_action.action === 'login' && token.recaptcha_action.score>= 0.8What if an attacker decides to call directly to the API whe

We are new to using reCAPTCHA enterprise and wanted to see if anyone has had firsthand experience on how to handle a situation when the reCAPTCHA endpoints are unavailable?Was there any try catch type code added to the webpage to avoid having issue at a later date?

Hello,I have implemented repatcha enterprise with the the score based assessment on on a register page.  At first a test website.Now I wonder what would be a non fraudulent score. If I use my email address I get a score of 0.89.Would it be ok if I assess all scores >= 0.7 as non-fraudulent? What would be a good starting point as a minimum score?I could log the scores and then compare the values over time. So I may could see what is a good minimum score.On the recaptcha enterprise website it states:"With low scores, require MFA or email verification to prevent credential stuffing attacks."Where could I set up MFA or email verification? Is there a documentation about it?Thank you for any recommendations. 

We had reCaptcha free for years. Around 6 months ago we've got notification that we are above the free threshold and we should move to the enterprise. In the last emails we had info that we have 800k above the limit (so in total 1.8M). 800k costs around 800$. We've moved to the enterprise version, had info that etimated billing is around 600$. Now after few days of usage estimated is 8000$. Hard to find explanation in the portal about the source of this spike. No spike in traffic, almost same levels as before. How to approach it?

reCAPTCHA has over a decade of experience defending the internet and data for its network of more than 5 million sites. reCAPTCHA Enterprise builds on this technology with capabilities, such as two-factor authentication and mobile application support, designed specifically for enterprise security concerns. With reCAPTCHA Enterprise, you can defend your website against common web-based attacks like credential stuffing, account takeovers, and scraping and help prevent costly exploits from malicious human and automated actors. And, just like reCAPTCHA v3, reCAPTCHA Enterprise will never interrupt your users with a challenge, so you can run it on all webpages where your customers interact with your services. In the video below, Customer Success Manager Nick Troutini, provides reCAPTCHA Enterprise users the information and resources you need to

Hello,I'm having a weird issue with Recaptcha Enterprise's authentication using Service Keys. I keep getting an unauthorized error (code 7) as a response every time I try to create an assessment despite the fact the Service Key has the required role, and the Recaptcha Site Key also exists. I'm also sure the Service Key is being located correctly since replacing it with another one from a different project I worked on (along with the appropriate Site Key) leads to the correct behavior, where I get an assessment and can interpret the score.Any idea what could cause such an error? Could I have missed something (although I did follow the guide's steps)?

Hi,We recently added enterprise recaptcha to all of our sites. However, we are having a hard time tracking usage compared to the 1,000.000 free requests. What's the best way to setup a usage tracker for this?Which metrics should we be looking at to get an accurate picture of our current usage across the entire project? We have about 300 separate keys so we need it to be global. I've looked at these https://cloud.google.com/monitoring/api/metrics_gcp#gcp-recaptchaenterprise but not sure if this would include all the billable resources being used. We set up something with the Usage panel but it doesn't seem to match when I look at individual usage for keys.  Any ideas or help would be greatly appreciated.Thanks!

We are trying to setup ReCAPTCHA in Google Enterprise, and the system is asking for a secret key. Where we can locate it? I've already followed the steps in here: https://cloud.google.com/recaptcha-enterprise/docs/create-key   i am seeing no metrics here: https://console.cloud.google.com/security/recaptcha/  

Hi, we have taken over a website which has the free version of WP contact form. We need to add a reCAPTCHA so I went into Google Cloud Console. Created the key, entered the key ID and secret key into WP form settings and it shows error as 'error for site owner, invalid key type' never had this before I have deleted and done it again but the same issue. Any ideas anyone? We will be redoing the site but for now we need to do this for his existing form. Thanks in advance!

Wish you knew more about the basics of reCAPTCHA? Or do you have a new-hire that could benefit from an overview of reCAPTCHA and its use cases? Or maybe you simply want a refresher on all things reCAPTCHA...   Well, you're in luck! reCAPTCHA is hosting our Onboarding Webinar, and you're invited!   Our next session will be hosted on 8/2/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you w

We're just 6 days away from reCAPTCHA hosting our first ever Onboarding Webinar! Make sure you and your team are registered and don't miss out.   The session will be hosted on 6/7/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you with the essential items and resources you’ll need to set you up for success with reCAPTCHA Enterprise.   You’ll learn: Where and how to get help with your technical questions or issues

reCAPTCHA is hosting our first ever Onboarding Webinar, and you're invited!   Our next session will be hosted on 6/7/2022 at 12pm MST. Please register here. (If you do not register, you will not receive the calendar and meeting invite).   This live session is for users of all levels and will provide you with the essential items and resources you’ll need to set you up for success with reCAPTCHA Enterprise.   You’ll learn: Where and how to get help with your technical questions or issues About the resources that are available to you at any time