reCAPTCHA

Some users are complaining that the reCAPTCHA keeps loading continuously when the page is accessed through Instagram's in-app browser. We switched the reCAPTCHA to invisible, but the request to generate the token is never completed.Browser:Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/21F90 Instagram 349.1.11.46.85 (iPhone11,8; iOS 17_5_1; pt_BR; pt-BR; scale=2.00; 828x1792; 643271179; IABMV/1)

We have integrated enterprise version of google recaptcha into our site , generated the keys for the same. Registered the domain name while creating the keys. however, while captcha gets rendered on the page, getting an error of "ERROR for site owner: Invalid key type for enterprise key."We haven't enable pricing for this enterprise version because the usage wouldn't go beyond 1million so billing wont be needed. I wonder would this be a reason for getting this error? 

Hello everyone,I am using WordPress with the Avada theme and have several Avada Forms on a single page, each using Google reCAPTCHA v2 (checkbox).Problem:Only the first form on the page works correctly. When I try to submit any additional form on the same page, I get this error message:"There was an error trying to send your message. Please try again later."If I remove the reCAPTCHA field from the additional forms, the forms submit without any problem. So it seems that multiple v2 checkboxes on one page are conflicting.What I’ve checked so far: Site key and secret key are correct. Domain is properly registered in the reCAPTCHA console. No caching/firewall rules are blocking reCAPTCHA. With only one form per page, everything

We are currently using a reCAPTCHA v3 Classic key for form submissions in our application. As per Google's recommendation, we are planning to migrate this key to the Google Cloud Platform (GCP).Before proceeding, we would like to clarify the following questions:Our current implementation references the script:https://www.google.com/recaptcha/api.js After migrating the Classic key to GCP, is it mandatory to update this reference to:https://www.google.com/recaptcha/enterprise.js? If we continue using the existing api.js reference after the migration, will the integration remain functional? Will the existing site key value change after migration? Or will the same key continue to be

The reliability and accuracy of Webrisk API response is going bad and out of sync with the response to the malicious urls when browsed on the chrome.Is there any plan or initiative to address these issues?

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

I encountered a problem about Google reCAPTCHA access.I created a new site-key for reCAPTCHA on Android and obtained a token.Now the problem is on the PHP server. When I verify the token, I get an error message: ACCESS_TOKEN_SCOPE_INSUFFICIENT.I tried many ways to handle it, but it still gives an error message. Please help me solve it.Detailed error message:CreateAssessment() call failed with the following error: Google\\ApiCore\\ApiException: {"reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT","domain": "googleapis.com","errorInfoMetadata": {"service": "recaptchaenterprise.googleapis.com","method": "google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseService.CreateAssessment"},"message": "Request had insufficient authentication scopes.","code": 7,"status": "PERMISSION_DENIED","details": [{"@type": "type.googleapis.com\\/google.rpc.ErrorInfo","reason": "ACCESS_TOKEN_SCOPE_INSUFFIC

"We are from a renowned security company, and we need to protect our clients' emails in our cloud security product. We attempt to click on URLs within these emails as part of this process. However, sometimes these URLs are protected by reCAPTCHA, which prevents us from accessing the content. We would like to know if there is a way for our company to contact reCAPTCHA to provide our IP addresses so that we can avoid encountering reCAPTCHA, thereby better protecting our clients."

I’m trying to integrate reCAPTCHA v3 with a Cloud Run backend. The client gets a token successfully, but when I verify it server-side using the reCAPTCHA API, I get a low score or timeout error.

We are sending the complete body as the documentation explain.We are trying to send verification code to phone number using sendVerificationCode endpoint. But got "Recaptcha verification failed - MALFORMED". we are sending the complete body as the documentation explain. Actually I am doing this:1- Call  https://identitytoolkit.googleapis.com/v1/recaptchaParams2- Call https://identitytoolkit.googleapis.com/v1/accounts:sendVerificationCode with the recaptcha token of the first enpoint call.The body: "phoneNumb

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

Hello Learners,  Have you ever wondered if there was a robot on the other side of the conversation? Or maybe if a robot is trying to access your content. Products like reCaptcha provide the fraud and bot protection that is critical in a world of scaling attacks on cloud resources. So please spend some time learning more about reCaptcha with our new course "Introduction to reCaptcha" which is now available on Google Cloud Skills Boost. In this course you can spend time learning the foundations of reCaptcha before working through a detailed lab that includes a blende

 I was wondering: if I refresh the web site page and recaptcha widget loads multiple times, does that increase my usage count? Or does the count only go up when I send the token to google server for verification?"

Hi,I created a website through Webflow web builder. I have used reCAPTCHA (v2) for my submission form. The site has been live for 2 weeks, and am able to receive submission forms.I received an email today from Google Cloud saying "You aren't protected". (snip below)In my Google Cloud console, the status reads - Unprotected: Finish setting up your key: Request scoresTo fully protect your site or app, finish setting up your key. Your key is requesting tokens (executes), but isn't requesting scores (assessments).I clicked "request scores" but this refers to code, which I don't have experience using/ implementing.Any assistant would be gratefully received to make status - Protected.Thanks

I have installed the Advanced google reCAPTCHA plugin ver2 to my domain "aquilbiz.com" and it is working but login out from my wordpress dashboard and tried to login it does not work. And this is happening again and again for the last 2 weeks or so. I have also contacted my servive provider for the purpose and they make it error free and both my website dashboard and cPanel dashboard worked. I reconfigured the secret key and the other key, but after login out and then login again the links for both the wordpress dashboard and cPanel did not opened.I have tried edge, chrome and firefox browsers after clearing the history of these browsers but the results are the same as attached here attached here. I have also applied DOS commands such as ipconfig /flushdns, etc., but the result is the sameSomebody please helpRegards,Aquil

Hello, We are integrating reCAPTCHA with our application. What google domains we need to whitelist in our firewall to reach this service? Is there any documentation which specifies this? Any help is appreciated. Thanks.  

Should I use different site key, for example 3 sites key for web, android, and iOS for backend verification in reCAPTCHA enterprise?

We are a large e-commerce platform based in the UK, operating multiple brands and serving a significant volume of mobile users. We have integrated Google reCAPTCHA across our services to ensure secure and seamless user interactions.Over the past week, we’ve observed a noticeable decline in reCAPTCHA scores for a majority of our mobile users. This change is affecting user experience and access across our platforms.Could you please confirm if there have been any recent updates or changes to the reCAPTCHA system—particularly those that might impact mobile device behavior or scoring? We would appreciate any insights or guidance to help us to address this issue.Thank you for your support.Gobinathan Subramani |

Hello,I am trying to create a recaptcha enterprise widget to integrate in our applications. I thought I was succesful till I deployed it to acceptance. Then i got the following error: Invalid action name: only A-Z, a-z, and _ are allowed. The recaptcha id on TST contained only alphanumeric characters, while the id on acc en prd contained a '-'.  If I try again with the id from tst, then everything works again, but not on acc.Any idea what could be wrong in my code? Or is my code not working for the enterprise version of recaptcha? // Define interface for propsinterface RecaptchaEnterpriseContainerProps {    siteKey: DynamicValue<string>; // SiteKey as DynamicValue

Dear Community Members, 🎉 Welcome to the reCAPTCHA Enterprise Community! 🎉 We’re thrilled to have you here. Whether you’re a seasoned developer, a security enthusiast, or just curious about reCAPTCHA Enterprise, this community is the place to connect, learn, and share your experiences. What is reCAPTCHA Enterprise? With reCAPTCHA Enterprise, you can protect your websites or mobile applications from spam and abuse, and detect other types of fraudulent activities on the sites, such as credential stuffing, account takeover (ATO), and automated account creation. Let’s explore the powerful features that reCAPTCHA Enterprise offers: Score-Based and Checkbox Challenges: Prevent account takeovers (ATOs) by using score-based and checkbox challenges. These mechanisms assess user interactions and provide

I've been following advice from Gemini to setup Keys for Enterprise. However, despite extensive back and forth, I can't get any keys to complete, they all show incomplete.I've added the domains, checked IAM permissions etc. but I just can't get them to complete. The error I get in Chrome console is: App Check Setup Error: grecaptcha.enterprise object is UNDEFINED after delay. reCAPTCHA script loaded, but Enterprise features not available with this key/config.Gemini tells me this error is because the Key is incomplete and suggests I ask in the forum for help.Any ideas welcome!

We are integrating Google reCAPTCHA with our website; however, we notice that, if we call Google to verify an invalid/expired reCAPTCHA token, our Google reCAPTCHA assessment usage will also be deducted. This raises a security concern: supposing if a malicious user uses a Python Script and keeps calling our API using a random string as reCAPTCHA token, and we bring this token to Google for verification, our reCAPTCHA quota will be exhausted very quickly. If we are transited to enterprise tier, we will lose $1 after processing every 1000 calls from the hacker. If a hacker is using DDOS attack, we may suffer great lost.So we have question to Google: Why calling Google to verify an invalid/expired reCAPTCHA token is also counted in reCAPTCHA usage?What's the Google's suggestion to handle such case? According to our research, blocking IP may be a effective way to protect us from being attacked. However, blocking IP may also harm the normal user, if

We have recaptcha v3 enterprise implemented on our mobile applications, while using appium scripts or android ui automator , the score returned from the assessment is 0.9, though there are no human gestures and these scripts mimic the behavior of a bot.At present we are testing in a small sample space of <10 users, will this be more predictable as user base grows ?

Planning to migrate from google reCAPTCHA V2 to reCAPTCHA enterprise , Please send step by step proc

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES