reCAPTCHA

I encountered a problem about Google reCAPTCHA access.I created a new site-key for reCAPTCHA on Android and obtained a token.Now the problem is on the PHP server. When I verify the token, I get an error message: ACCESS_TOKEN_SCOPE_INSUFFICIENT.I tried many ways to handle it, but it still gives an error message. Please help me solve it.Detailed error message:CreateAssessment() call failed with the following error: Google\\ApiCore\\ApiException: {"reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT","domain": "googleapis.com","errorInfoMetadata": {"service": "recaptchaenterprise.googleapis.com","method": "google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseService.CreateAssessment"},"message": "Request had insufficient authentication scopes.","code": 7,"status": "PERMISSION_DENIED","details": [{"@type": "type.googleapis.com\\/google.rpc.ErrorInfo","reason": "ACCESS_TOKEN_SCOPE_INSUFFIC

"We are from a renowned security company, and we need to protect our clients' emails in our cloud security product. We attempt to click on URLs within these emails as part of this process. However, sometimes these URLs are protected by reCAPTCHA, which prevents us from accessing the content. We would like to know if there is a way for our company to contact reCAPTCHA to provide our IP addresses so that we can avoid encountering reCAPTCHA, thereby better protecting our clients."

I’m trying to integrate reCAPTCHA v3 with a Cloud Run backend. The client gets a token successfully, but when I verify it server-side using the reCAPTCHA API, I get a low score or timeout error.

We are sending the complete body as the documentation explain.We are trying to send verification code to phone number using sendVerificationCode endpoint. But got "Recaptcha verification failed - MALFORMED". we are sending the complete body as the documentation explain. Actually I am doing this:1- Call  https://identitytoolkit.googleapis.com/v1/recaptchaParams2- Call https://identitytoolkit.googleapis.com/v1/accounts:sendVerificationCode with the recaptcha token of the first enpoint call.The body: "phoneNumb

Loading a page with recaptcha on Safari for iOS 16 and above, (es. user agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1) the request https://www.google.com/recaptcha/api2/pat returns 401 and recaptcha initialization fails.Additional details can be found in this Github issue https://github.com/google/recaptcha/issues/561 (49 upvotes), but I ask the participants to comment here too.

Hello Learners,  Have you ever wondered if there was a robot on the other side of the conversation? Or maybe if a robot is trying to access your content. Products like reCaptcha provide the fraud and bot protection that is critical in a world of scaling attacks on cloud resources. So please spend some time learning more about reCaptcha with our new course "Introduction to reCaptcha" which is now available on Google Cloud Skills Boost. In this course you can spend time learning the foundations of reCaptcha before working through a detailed lab that includes a blende

 I was wondering: if I refresh the web site page and recaptcha widget loads multiple times, does that increase my usage count? Or does the count only go up when I send the token to google server for verification?"

Hi,I created a website through Webflow web builder. I have used reCAPTCHA (v2) for my submission form. The site has been live for 2 weeks, and am able to receive submission forms.I received an email today from Google Cloud saying "You aren't protected". (snip below)In my Google Cloud console, the status reads - Unprotected: Finish setting up your key: Request scoresTo fully protect your site or app, finish setting up your key. Your key is requesting tokens (executes), but isn't requesting scores (assessments).I clicked "request scores" but this refers to code, which I don't have experience using/ implementing.Any assistant would be gratefully received to make status - Protected.Thanks

I have installed the Advanced google reCAPTCHA plugin ver2 to my domain "aquilbiz.com" and it is working but login out from my wordpress dashboard and tried to login it does not work. And this is happening again and again for the last 2 weeks or so. I have also contacted my servive provider for the purpose and they make it error free and both my website dashboard and cPanel dashboard worked. I reconfigured the secret key and the other key, but after login out and then login again the links for both the wordpress dashboard and cPanel did not opened.I have tried edge, chrome and firefox browsers after clearing the history of these browsers but the results are the same as attached here attached here. I have also applied DOS commands such as ipconfig /flushdns, etc., but the result is the sameSomebody please helpRegards,Aquil

Hello, We are integrating reCAPTCHA with our application. What google domains we need to whitelist in our firewall to reach this service? Is there any documentation which specifies this? Any help is appreciated. Thanks.  

Should I use different site key, for example 3 sites key for web, android, and iOS for backend verification in reCAPTCHA enterprise?

We are a large e-commerce platform based in the UK, operating multiple brands and serving a significant volume of mobile users. We have integrated Google reCAPTCHA across our services to ensure secure and seamless user interactions.Over the past week, we’ve observed a noticeable decline in reCAPTCHA scores for a majority of our mobile users. This change is affecting user experience and access across our platforms.Could you please confirm if there have been any recent updates or changes to the reCAPTCHA system—particularly those that might impact mobile device behavior or scoring? We would appreciate any insights or guidance to help us to address this issue.Thank you for your support.Gobinathan Subramani |

Hello,I am trying to create a recaptcha enterprise widget to integrate in our applications. I thought I was succesful till I deployed it to acceptance. Then i got the following error: Invalid action name: only A-Z, a-z, and _ are allowed. The recaptcha id on TST contained only alphanumeric characters, while the id on acc en prd contained a '-'.  If I try again with the id from tst, then everything works again, but not on acc.Any idea what could be wrong in my code? Or is my code not working for the enterprise version of recaptcha? // Define interface for propsinterface RecaptchaEnterpriseContainerProps {    siteKey: DynamicValue<string>; // SiteKey as DynamicValue

Dear Community Members, 🎉 Welcome to the reCAPTCHA Enterprise Community! 🎉 We’re thrilled to have you here. Whether you’re a seasoned developer, a security enthusiast, or just curious about reCAPTCHA Enterprise, this community is the place to connect, learn, and share your experiences. What is reCAPTCHA Enterprise? With reCAPTCHA Enterprise, you can protect your websites or mobile applications from spam and abuse, and detect other types of fraudulent activities on the sites, such as credential stuffing, account takeover (ATO), and automated account creation. Let’s explore the powerful features that reCAPTCHA Enterprise offers: Score-Based and Checkbox Challenges: Prevent account takeovers (ATOs) by using score-based and checkbox challenges. These mechanisms assess user interactions and provide

I've been following advice from Gemini to setup Keys for Enterprise. However, despite extensive back and forth, I can't get any keys to complete, they all show incomplete.I've added the domains, checked IAM permissions etc. but I just can't get them to complete. The error I get in Chrome console is: App Check Setup Error: grecaptcha.enterprise object is UNDEFINED after delay. reCAPTCHA script loaded, but Enterprise features not available with this key/config.Gemini tells me this error is because the Key is incomplete and suggests I ask in the forum for help.Any ideas welcome!

We are integrating Google reCAPTCHA with our website; however, we notice that, if we call Google to verify an invalid/expired reCAPTCHA token, our Google reCAPTCHA assessment usage will also be deducted. This raises a security concern: supposing if a malicious user uses a Python Script and keeps calling our API using a random string as reCAPTCHA token, and we bring this token to Google for verification, our reCAPTCHA quota will be exhausted very quickly. If we are transited to enterprise tier, we will lose $1 after processing every 1000 calls from the hacker. If a hacker is using DDOS attack, we may suffer great lost.So we have question to Google: Why calling Google to verify an invalid/expired reCAPTCHA token is also counted in reCAPTCHA usage?What's the Google's suggestion to handle such case? According to our research, blocking IP may be a effective way to protect us from being attacked. However, blocking IP may also harm the normal user, if

We have recaptcha v3 enterprise implemented on our mobile applications, while using appium scripts or android ui automator , the score returned from the assessment is 0.9, though there are no human gestures and these scripts mimic the behavior of a bot.At present we are testing in a small sample space of <10 users, will this be more predictable as user base grows ?

Planning to migrate from google reCAPTCHA V2 to reCAPTCHA enterprise , Please send step by step proc

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES

I'm getting the following message.Finish setting up your key: Request tokens To protect your site or app, finish setting up your key. Start by requesting tokens (executes).My website is a Wordpress Site and I'm using the plugin WP Forms.  I have others I setup the same way and they say protected and I didn't have to request tokens.  what am I missing?

Hi, I've installed Recaptcha 3 on a Wordpress site that uses Job Manager. I've put the Recaptcha key into Job Manager and Recaptcha is confirming that it's set up correctly. But there is a bot that is repeatedly sending job applications in via the Job Manager form, and is not getting stopped by Recaptcha. I've tried fully deleting the job that the bot is attacking, but it just jumps to another one.The Job Manager developers have said it's a Recaptcha problem, not them and to talk to Google. Apparently though Google don't provide help unless you pay for it?? So I'm stuck. Can someone please point me in the right direction on how to fix this and stop the bot applications.

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

Hello,We are using reCAPTCHA in company web application.However, since we are testing the application heavy, submitting similar data, we eventually get low score and cannot submit anymore.  Is there a effective way to whitelist user IP address or domain?Thanks in advance.

Hello team,I recently analyzed a targeted SMS registration attack against our mobile application and discovered something puzzling. Despite clear indicators of malicious behavior, Google reCAPTCHA v3 assigned these requests a relatively high score of 0.7 (with 1.0 being completely trusted human users).Attack Overview:Traffic originated from multiple hosting provider IPs across different continentsAll requests used identical app version but varied device modelsSystematic targeting of both registration and activation endpointsThe attack focused on specific activation code patternsThe Confusion: Why would reCAPTCHA v3 score these obvious automated attack requests from hosting servers as 0.7? Shouldn't this receive a very low score? Our threshold is set at 0.5, so these requests were considered "probably legitimate" by the system, just slightly suspicious.

We want to enable the silos service for our project. As we are trying to implement the Password check in the ReCAPTCHA Site key. Can any one help us to check the same whether the service could be enabled by the account administrator and have to contact the GCP support team.And how we can enable the password check in the Site Key.Thanks!