Skip to main content

reCAPTCHA

Whether you're troubleshooting an issue, seeking integration advice, or want to discuss the latest reCAPTCHA updates, this is your space to collaborate and learn.

  • 230 Topics
  • 385 Replies
230 Topics
Umairbadar39
Umairbadar39New Member
asked in reCAPTCHA
Firebase Phone Auth > reCAPTCHA Enterprise won't disable after turning off in console (iOS, React Native)

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

460
Umairbadar39
G
GeorgeAnNew Member
posted in reCAPTCHA
a problem about Google reCAPTCHA access

I encountered a problem about Google reCAPTCHA access.I created a new site-key for reCAPTCHA on Android and obtained a token.Now the problem is on the PHP server. When I verify the token, I get an error message: ACCESS_TOKEN_SCOPE_INSUFFICIENT.I tried many ways to handle it, but it still gives an error message. Please help me solve it.Detailed error message:CreateAssessment() call failed with the following error: Google\\ApiCore\\ApiException: {"reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT","domain": "googleapis.com","errorInfoMetadata": {"service": "recaptchaenterprise.googleapis.com","method": "google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseService.CreateAssessment"},"message": "Request had insufficient authentication scopes.","code": 7,"status": "PERMISSION_DENIED","details": [{"@type": "type.googleapis.com\\/google.rpc.ErrorInfo","reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT","domain": "googleapis.com","metadata": {"service": "recaptchaenterprise.googleapis.com","method": "google

311
faube
Staff
F
ForestersNew Member
posted in reCAPTCHA
ReCAPTCHA v3 has been giving low scores to many users

We have ReCAPTCHA enterprise and have integrated with ReCAPTCHA v3 in our online application. Since about two weeks ago, ReCAPTCHA has been giving low scores, i.e. below 0.5, to a lot of our online users which prevented them from logging into their accounts. The number of low scores has increased by fivefold as compared to a couple of weeks ago, and is still in a trend of increasing.Could you advise what might be the reason behind this, given we haven't made a change to our ReCAPTCHA implementation?

2456
C
R
RitchiedDingNew Member
posted in reCAPTCHA
WhiteList for reCAPTCHA

"We are from a renowned security company, and we need to protect our clients' emails in our cloud security product. We attempt to click on URLs within these emails as part of this process. However, sometimes these URLs are protected by reCAPTCHA, which prevents us from accessing the content. We would like to know if there is a way for our company to contact reCAPTCHA to provide our IP addresses so that we can avoid encountering reCAPTCHA, thereby better protecting our clients."

649
shibszer
G
globalpressnnNew Member
posted in reCAPTCHA
Issue with reCAPTCHA Verification Token on Cloud Run

I’m trying to integrate reCAPTCHA v3 with a Cloud Run backend. The client gets a token successfully, but when I verify it server-side using the reCAPTCHA API, I get a low score or timeout error.

110
G
S
ShahzadAhmadNew Member
asked in reCAPTCHA
Recaptcha verification failed - MALFORMED

We are sending the complete body as the documentation explain.We are trying to send verification code to phone number using sendVerificationCode endpoint. But got "Recaptcha verification failed - MALFORMED". we are sending the complete body as the documentation explain. Actually I am doing this:1- Call  https://identitytoolkit.googleapis.com/v1/recaptchaParams2- Call https://identitytoolkit.googleapis.com/v1/accounts:sendVerificationCode with the recaptcha token of the first enpoint call.The body: "phoneNumber": string, "recaptchaToken": string, Then i get this error: "CAPTCHA_CHECK_FAILED : Recaptcha verification failed - MALFORMED" Are we missing something? Thanks

1619
R
T
tommagNew Member
posted in reCAPTCHA
reCAPTCHA initialization error on Safari iOS 16+

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

44512
V
ScienceCat
Staff
ScienceCatStaff
posted in reCAPTCHA
Course Launch Announcement: Introduction to reCaptcha

Hello Learners,  Have you ever wondered if there was a robot on the other side of the conversation? Or maybe if a robot is trying to access your content. Products like reCaptcha provide the fraud and bot protection that is critical in a world of scaling attacks on cloud resources. So please spend some time learning more about reCaptcha with our new course "Introduction to reCaptcha" which is now available on Google Cloud Skills Boost. In this course you can spend time learning the foundations of reCaptcha before working through a detailed lab that includes a blended use of Cloud Armor for bot protection. Whether you are a developer looking to sharpen up on reCaptcha for your app or perhaps a security expert who needs to get deeper context on what exactly recCaptcha can do for you in the enterprise, drop in our new course.  Course Details & LINK: "This course equips learners with the information they need to deploy reCAPTCHA in their websites, mobile ap

30
ScienceCat
Staff
Y
YoontaeyoungNew Member
posted in reCAPTCHA
Recaptcha billing

 I was wondering: if I refresh the web site page and recaptcha widget loads multiple times, does that increase my usage count? Or does the count only go up when I send the token to google server for verification?"

141
faube
Staff
PaulHarvey
PaulHarveyNew Member
posted in reCAPTCHA
Finish setting up your key: Request scores

Hi,I created a website through Webflow web builder. I have used reCAPTCHA (v2) for my submission form. The site has been live for 2 weeks, and am able to receive submission forms.I received an email today from Google Cloud saying "You aren't protected". (snip below)In my Google Cloud console, the status reads - Unprotected: Finish setting up your key: Request scoresTo fully protect your site or app, finish setting up your key. Your key is requesting tokens (executes), but isn't requesting scores (assessments).I clicked "request scores" but this refers to code, which I don't have experience using/ implementing.Any assistant would be gratefully received to make status - Protected.Thanks

1193
PaulHarvey
K
Kashif61New Member
posted in reCAPTCHA
reCATCHA is problematic

I have installed the Advanced google reCAPTCHA plugin ver2 to my domain "aquilbiz.com" and it is working but login out from my wordpress dashboard and tried to login it does not work. And this is happening again and again for the last 2 weeks or so. I have also contacted my servive provider for the purpose and they make it error free and both my website dashboard and cPanel dashboard worked. I reconfigured the secret key and the other key, but after login out and then login again the links for both the wordpress dashboard and cPanel did not opened.I have tried edge, chrome and firefox browsers after clearing the history of these browsers but the results are the same as attached here attached here. I have also applied DOS commands such as ipconfig /flushdns, etc., but the result is the sameSomebody please helpRegards,Aquil

10
K
K
Kaizen10New Member
posted in reCAPTCHA
what domains to whitelist for reCAPTCHA

Hello, We are integrating reCAPTCHA with our application. What google domains we need to whitelist in our firewall to reach this service? Is there any documentation which specifies this? Any help is appreciated. Thanks.  

80
K
A
andrianramadanNew Member
posted in reCAPTCHA
Different ReCAPTCHA for different many platform?

Should I use different site key, for example 3 sites key for web, android, and iOS for backend verification in reCAPTCHA enterprise?

31
faube
Staff
G
gobinathan_SNew Member
posted in reCAPTCHA
Inquiry Regarding Drop in reCAPTCHA Scores for Mobile Users

We are a large e-commerce platform based in the UK, operating multiple brands and serving a significant volume of mobile users. We have integrated Google reCAPTCHA across our services to ensure secure and seamless user interactions.Over the past week, we’ve observed a noticeable decline in reCAPTCHA scores for a majority of our mobile users. This change is affecting user experience and access across our platforms.Could you please confirm if there have been any recent updates or changes to the reCAPTCHA system—particularly those that might impact mobile device behavior or scoring? We would appreciate any insights or guidance to help us to address this issue.Thank you for your support.Gobinathan Subramani |

30
G
W
wouterkNew Member
asked in reCAPTCHA
Recaptcha enterprise is failing because of invalid sitekey

Hello,I am trying to create a recaptcha enterprise widget to integrate in our applications. I thought I was succesful till I deployed it to acceptance. Then i got the following error: Invalid action name: only A-Z, a-z, and _ are allowed. The recaptcha id on TST contained only alphanumeric characters, while the id on acc en prd contained a '-'.  If I try again with the id from tst, then everything works again, but not on acc.Any idea what could be wrong in my code? Or is my code not working for the enterprise version of recaptcha? // Define interface for propsinterface RecaptchaEnterpriseContainerProps {    siteKey: DynamicValue<string>; // SiteKey as DynamicValue    token: EditableValue<string>; // EditableValue to interact with the Mendix attribute    onVerify: { execute: () => void }; // Callback for verification}// Component to handle reCAPTCHA Enterprise logicconst ReCaptchaEnterprise = ({    siteKey, 

302
W
A
amitairBronze 2
posted in reCAPTCHA
Welcome to the reCAPTCHA community forum!

Dear Community Members, 🎉 Welcome to the reCAPTCHA Enterprise Community! 🎉 We’re thrilled to have you here. Whether you’re a seasoned developer, a security enthusiast, or just curious about reCAPTCHA Enterprise, this community is the place to connect, learn, and share your experiences. What is reCAPTCHA Enterprise? With reCAPTCHA Enterprise, you can protect your websites or mobile applications from spam and abuse, and detect other types of fraudulent activities on the sites, such as credential stuffing, account takeover (ATO), and automated account creation. Let’s explore the powerful features that reCAPTCHA Enterprise offers: Score-Based and Checkbox Challenges: Prevent account takeovers (ATOs) by using score-based and checkbox challenges. These mechanisms assess user interactions and provide real-time risk scores, allowing you to take appropriate actions based on the level of risk. Multi-Factor Authentication (MFA): Verify an end user’s identity using MFA. This adds

151
A
C
ColNew Member
posted in reCAPTCHA
reCAPTCHA Enterprise - Incomplete

I've been following advice from Gemini to setup Keys for Enterprise. However, despite extensive back and forth, I can't get any keys to complete, they all show incomplete.I've added the domains, checked IAM permissions etc. but I just can't get them to complete. The error I get in Chrome console is: App Check Setup Error: grecaptcha.enterprise object is UNDEFINED after delay. reCAPTCHA script loaded, but Enterprise features not available with this key/config.Gemini tells me this error is because the Key is incomplete and suggests I ask in the forum for help.Any ideas welcome!

90
C
J
JoeyWuNew Member
posted in reCAPTCHA
Need suggestions to prevent Google reCAPTCHA Quota Exhaustion Attack

We are integrating Google reCAPTCHA with our website; however, we notice that, if we call Google to verify an invalid/expired reCAPTCHA token, our Google reCAPTCHA assessment usage will also be deducted. This raises a security concern: supposing if a malicious user uses a Python Script and keeps calling our API using a random string as reCAPTCHA token, and we bring this token to Google for verification, our reCAPTCHA quota will be exhausted very quickly. If we are transited to enterprise tier, we will lose $1 after processing every 1000 calls from the hacker. If a hacker is using DDOS attack, we may suffer great lost.So we have question to Google: Why calling Google to verify an invalid/expired reCAPTCHA token is also counted in reCAPTCHA usage?What's the Google's suggestion to handle such case? According to our research, blocking IP may be a effective way to protect us from being attacked. However, blocking IP may also harm the normal user, if the normal user shares the same

122
J
R
rajiacNew Member
posted in reCAPTCHA
Unexpected score returned from recaptcha enterprise v3 assessment

We have recaptcha v3 enterprise implemented on our mobile applications, while using appium scripts or android ui automator , the score returned from the assessment is 0.9, though there are no human gestures and these scripts mimic the behavior of a bot.At present we are testing in a small sample space of <10 users, will this be more predictable as user base grows ?

32
faube
Staff
V
vijayapalvNew Member
posted in reCAPTCHA
Planning to migrate from google reCAPTCHA V2 to reCAPTCHA enterprise , Please send step by step proc

Planning to migrate from google reCAPTCHA V2 to reCAPTCHA enterprise , Please send step by step proc

31
faube
Staff
N
NESFNew Member
posted in reCAPTCHA
Recaptcha failing on download from Middle East

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES

30
N
B
bmw2182New Member
posted in reCAPTCHA
reCaptcha saying incomplete

I'm getting the following message.Finish setting up your key: Request tokens To protect your site or app, finish setting up your key. Start by requesting tokens (executes).My website is a Wordpress Site and I'm using the plugin WP Forms.  I have others I setup the same way and they say protected and I didn't have to request tokens.  what am I missing?

762
B
H
hrontapNew Member
posted in reCAPTCHA
Recaptcha not stopping a bot

Hi, I've installed Recaptcha 3 on a Wordpress site that uses Job Manager. I've put the Recaptcha key into Job Manager and Recaptcha is confirming that it's set up correctly. But there is a bot that is repeatedly sending job applications in via the Job Manager form, and is not getting stopped by Recaptcha. I've tried fully deleting the job that the bot is attacking, but it just jumps to another one.The Job Manager developers have said it's a Recaptcha problem, not them and to talk to Google. Apparently though Google don't provide help unless you pay for it?? So I'm stuck. Can someone please point me in the right direction on how to fix this and stop the bot applications.

221
a_aleinikov
joe457
joe457New Member
posted in reCAPTCHA
ReCAPTCHA IP reputation problem

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

172
joe457
S
sunilAtHcNew Member
posted in reCAPTCHA
Whitelisting user in reCAPTCHA

Hello,We are using reCAPTCHA in company web application.However, since we are testing the application heavy, submitting similar data, we eventually get low score and cannot submit anymore.  Is there a effective way to whitelist user IP address or domain?Thanks in advance.

422
faube
Staff

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.