Hello cameron123,

reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion. reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics.

Note: reCAPTCHA tokens expire after two minutes. If you're protecting an action with reCAPTCHA, make sure to call execute when the user takes the action rather than on page load.

We are using firebase.auth.RecaptchaVerifier from firebase npm package 8.10.1. This depends on @firebase/auth 0.16.8. There are no dependencies on a recaptcha package. I see API calls to:

https://www.googleapis.com/identitytoolkit/v3/relyingparty/getRecaptchaParam
https://www.google.com/recaptcha/api2/reload
https://www.google.com/recaptcha/api2/userverify
https://www.google.com/recaptcha/api2/reload

It's the same API calls whether the SMS works or not. it's v2 of recaptcha, always. sometimes mfa works and sometimes it doesn't

@cameron123have you got any solution for this? I am also getting the same error and same behaviour sometimes it works and sometimes doesn't

no unfortunately not and it’s annoyingly intermittent. I recreated the problem again today so it’s still persisting for me.

Do you use a vpc service perimeter on your google project? I’m wondering if it’s related

We are not using vpc service perimeter.