reCAPTCHA

Hi Team, We are getting an invalid recaptcha error with a risk analysis score of 0.3. We need to know why we are getting a score of 0.3 while sending tokens to the recaptcha token validation API through the mobile app when user doing some interactions. Please find the below response and find more details. Also we got success response at intermittent time {"status_code":"invalid_recaptcha","invalid_request":"invalid reCAPTCHA token","recaptcha_response":{"riskAnalysis":{"score":0.3,"reasons":[],"extendedVerdictReasons":[],"challenge":"CHALLENGE_UNSPECIFIED"},"name":"projects/31661614596/assessments/6071678a6a000000","tokenProperties":{"valid":true,"hostname":"","createTime":"2024-11-04T12:16:55.900Z","androidPackageName":"","iosBundleId":"org.ahm-ahfc.ahfc.*****","action":"login","invalidReason":"INVALID_REASON_UNSPECIFIED"},"accountDefenderAssessment":{"labels":[]},"event":{"headers":[],"requestedUri":"","firewallPolicyEvaluation":false,"wafTokenAssessment":false,"fraudPrevention":"FRA

Do we need a BAA signed for enterprise recaptcha? If so, how do we obtain it

Currently I have a Google account for my organization.Under it I have 2 active api's (HSHSPublicGeocodingAPI and HSHSBizRecaptcha). The reCAPTCHA v2 account is Enterprise. I am being asked if I can add another reCAPTCHA Enterprise account, v3 under HSHSBizRecaptcha. Looking at documentation I think I can but I want to be sure so I can relay that information. If not, I guess the requestor can create another Google account and create their own reCAPTCHA account. Thanks in advance.

I integrated reCAPTCHA Enterprise (score-based) in my web application. Everything is working fine, and I am getting the score. I want to configure "Account Defender" and "SMS toll fraud protection."  For "SMS toll fraud protection", I am sending the account identifier to the API. While configuring the account defender, getting an API error in "Annotate Login Events". Below is my code1. First I created the reCAPTCHA Enterprise assessment, got the assessment_id (name field), and sent that assessment_id to annotate the assessmentconst url = `https://recaptchaenterprise.googleapis.com/v1/${result}:annotate`;const data = {"annotation": "LEGITIMATE","reasons": "REASON_UNSPECIFIED"};fetch(url, {method: 'POST',mode: 'no-cors',body: JSON.stringify(data),headers: {'Content-Type': 'application/json','Authorization': 'Bearer APIKEY'}}).then(response => {if (response.ok) {return response.json();}else if (response.status === 404) {console.error("Assessment ID not found:", assessmentId);// Ha

Hi Team,We use google captcha V3 for bot detection and when the score is low, we fallback to V2 to challenge the user. We have setup both v3 and v2 as per the docs. We use javascript to programmatically execute V3 and V2 using `grecaptcha.execute( )` method. The issue here is that, the registered callback for V2 is not getting triggered for some cases due to which the users are stuck in the captcha step. It gets triggered for staging environment but not in production. Need to understand what is missing here. TLDR; Registered the callback in `render` method of V2 as per docs. Calling `execute` invokes the challenge but the callback is not triggered post that.  

exact error : POST https://recaptchaenterprise.googleapis.com/v1/projects/770978332111/assessments/1a4b51fac6000000:annotate net::ERR_ABORTED 400 (Bad Request)code:async function annotateAssessment(assessmentID, annotation, reasons, accountId) {const annotateUrl = `https://recaptchaenterprise.googleapis.com/v1/${assessmentID}:annotate`;const annotateData = {annotation: "", // "LEGITIMATE" or "FRAUDULENT"reasons: reasons, // Optional array of reasons (e.g., ["AUTOMATION"])accountId: "" // Optional, the identifier for the user's account on your website};try {const response = await fetch(annotateUrl, {method: 'POST',mode: 'no-cors',body: JSON.stringify(annotateData),headers: {'Content-Type': 'application/json','Authorization': 'Bearer my token' , // Include your reCAPTCHA API token here}});if (!response.ok) {// Handle HTTP errorsconst errorData = await response.json();console.error("Error annotating the assessment:", errorData);return;}const result = await response.json();console.log

exact error : POST https://recaptchaenterprise.googleapis.com/v1/projects/770978332111/assessments/1a4b51fac6000000:annotate net::ERR_ABORTED 400 (Bad Request)code:async function annotateAssessment(assessmentID, annotation, reasons, accountId) {const annotateUrl = `https://recaptchaenterprise.googleapis.com/v1/${assessmentID}:annotate`;const annotateData = {annotation: "", // "LEGITIMATE" or "FRAUDULENT"reasons: reasons, // Optional array of reasons (e.g., ["AUTOMATION"])accountId: "" // Optional, the identifier for the user's account on your website};try {const response = await fetch(annotateUrl, {method: 'POST',mode: 'no-cors',body: JSON.stringify(annotateData),headers: {'Content-Type': 'application/json','Authorization': 'Bearer my token' , // Include your reCAPTCHA API token here}});if (!response.ok) {// Handle HTTP errorsconst errorData = await response.json();console.error("Error annotating the assessment:", errorData);return;}const result = await response.json();console.log

What could be the reasons for receiving a 404 Bad Request error when calling the annotate method at the recaptchaenterprise.googleapis.com/v1/ASSESSMENT_ID:annotate, and how can we troubleshoot this issue?

Hi, I need support to implement a Captcha in a form of my Angular PrimeNG app (backend PHP). I'm facing an issue : the variable grecaptcha is unknown. I use this link in my index.html file : <script src="https://www.google.com/recaptcha/enterprise.js" async defer></script> Looking forward to getting in touch, Sam 

Hi all, I have been working on moving Gmail SMTP for a set of client Wordpress sites under their company account. With the mail settings all went well.Since they are also using Contact Form 7 with reCAPTCHA v3, they started getting impersonation alerts as the reCAPTCHA was configured from a non-business Gmail address. So, logically, on 7th Oct I moved the captcha configuration under their company account as well, but since yesterday we're getting alert about the configuration not working because it's missing "an assessment".   Additionally, each site key will often be green and then without any changes anywhere move to red or randomly move from red to yellow. Can you explain how to understand this? Why are the keys randomly changing status? Why do 2 different domains with analogous configuration get different security rating? (red vs orange, see below, they are team member websites so exactly the same except the copy)Also, is there a WP plugin that is set up to requests

Hi all, I have been working on moving Gmail SMTP for a set of client Wordpress sites under their company account. With the mail settings all went well.Since they are also using Contact Form 7 with reCAPTCHA v3, they started getting impersonation alerts as the reCAPTCHA was configured from a non-business Gmail address. So, logically, on 7th Oct I moved the captcha configuration under their company account as well, but since yesterday we're getting alert about the configuration not working because it's missing "an assessment".  Additionally, each site key will often be green and then without any changes anywhere move to red or randomly move from red to yellow. Can you explain how to understand this? Why are the keys randomly changing status? Why do 2 different domains with analogous configuration get different security rating? (red vs orange, see below, they are team member websites so exactly the same except the copy) Also, is there a WP plugin that is set up to requests

In our case we are seeing a case where recaptcha is failing our request for a user agent while it is success for the same user agent at other times. What could be the reason behind this. Sometime we got browser error, sometimes score as 0 and sometimes very low score for the same request. 

I started with recaptcha free https://www.google.com/recaptcha/admin/create. I included all required fields, creating a new Google Cloud Project Name. Hit enter, nothing happened. No error, no change on page. Tried multiple browsers. Same result.  I thought may I need to create the Project before referencing its name. I did that on https://console.cloud.google.com/security/recaptcha/. Found no secret key. How can I create recaptcha for my site with a secret key? 

recaptcha key creation is not working, tried mobile, desktop and 2 browser chrome/mozilla, when i hit "Submit" nothing happens. can someone confirm is not working also for them?

Hello, I would like to know how to select a reCAPTCHA pricing plan.The official website introduces three pricing plans: reCAPTCHA Essentials, reCAPTCHA Standard, and reCAPTCHA Enterprise. Additionally, it mentions that you can start using reCAPTCHA by navigating to the console from "Get started" or "Manage reCAPTCHA." However, I am unsure how to select a pricing plan within the console. I also don't know how to check which pricing plan I am currently using.The following points might be relevant, so I am providing them for reference:I am using a free trial account.The key setup has not been completed yet.The pricing structure may have changed recently, and the documentation or GUI may not be fully updated.Here’s what I’ve tried so far:I created a project with a free trial account and enabled the reCAPTCHA API.I issued a regular key (not for demo or testing purposes), but I haven't implemented it on the website yet.

Hi there!I hope this message finds you well.I am currently experiencing issues with my reCAPTCHA integration. I have set up a reCAPTCHA key, but I am encountering several specific problems:Backend Verification Incomplete: I received a message stating, "Your key isn't requesting assessments," indicating that the backend verification for reCAPTCHA isn’t fully configured.Key Setup Completion: I also received a notification to "Finish setting up your key: Request scores." This suggests that while my key is requesting tokens (executes), it isn’t requesting scores (assessments), which is essential for fully protecting my site.Authentication Required: Additionally, there’s an error saying, "Before proceeding, you must authenticate with reCAPTCHA. API requests to reCAPTCHA will fail until authentication steps are complete."I have reviewed the instructions for verifying reCAPTCHA tokens but am unsure how they relate to my Salesforce backend, as the reCAPTCHA API Key Pair is also generated there

Clicking Submit on the Recaptcha key generator is doing nothing; no error, nothing.  Anyone else seeing this? I have tried with 3 machines and on each tried several browses/incognito. https://www.loom.com/share/64320b7f364c416594a86ec10cfe1ea3?sid=8ac9ac2d-f643-452b-8eeb-7d6050fb86f2

Hi, we have reCAPTCHA Enterprise 18.5.1 in our Android app. The app is live in production and reCAPTCHA works correctly. We are testing the app on a genuine, unlocked Pixel 8 running Android 15 beta 4, but we are getting a low score of 0.4 and an INVALID_REASON_UNSPECIFIED.Below an assessment response:{ tokenProperties={ valid=true, hostname=, action=ACCOUNTCREATION, createTime=Thu Oct 10 13:09:07 UTC 2024, invalidReason=INVALID_REASON_UNSPECIFIED }, riskAnalysis={ score=0.4, reasons=[] }, event={ token=03AFcWeA7ZC9iCZpVKfzMYOVLJdaPhEUHG6fJjAS1ZLs5jAZIHyt8ADPR_EAy6qA5AuZb2gxI-WIbb1bLPF46NKfraoelyFe-GeXkp2lo184rQ_Kr5ysTCOf-Uw80WXO2vtbWOB2STtNlmYREyOmbDgOjlg3qVhgKQ6XTa2n5UVcyvC08gnMrRGPf09tgyEEplpKrXzXMvGjqDeyp4YgkKHRukFKxHpH30EXRKICI3_qTZ0nClR9tBjuUXCWF6DE53aFUoIXzgcKE9PtxXHcbrHboRe0meS0bPNMvSskIJ13UN1Th7CSWkUs5LNLBj3ChkQx5xgj1y5thfju2_trlXLorBsRDR06vOAh3MG0vC9sknEM_npPQd-ujj9HaCN3CM5PO78Tf_zTFot-A4Oq1KqG6bee_SZDUFNjMbld1iwTd8eNDGqa16L-vjBWNK9830t7

Has anyone else ran into a problem where the reCAPTCHA admin console shows different things than the enterprise cloud console? One of my reCAPTCHA sites appears to be orphaned into a different project that doesn't show in my enterprise cloud account. So now I'm having licensing issues with the site saying its over the agreement amount. If I attempt to use CLI  gcloud config set project abcdefg - I'm told my owner account doesn't have access to the projects instance. I'm simply trying to move it somehow so I don't have to reconfigure another one. Any tips tricks or help would be greatly appreciated!

Hello,I am a webdesigner. For many of the websites I build for my clients, I set up a ReCaptcha for the website forms. In 2019, this turned into a "paid" service, for which I get an invoice for €0,00 every month, as the number of clicks stays well below the number from which actual payments are incurred. In most cases, I set this up with a gmail account of my client, and added my own Google account so I could manage the ReCaptcha for them if necessary. Bottom line: about 30 different recaptchas in my account. To my dismay, this month I received an invoice for an actual payment. I checked on the site, but the setup is so unbelievable unclear for these Google tools, I cannot make out which sites incurred this traffic, and why it would be billed to me, instead of the the client's Google account.Can someone explain to me please which account(s) is/are billed on incurring costs with a recaptcha? I hope I selected the proper Cloud Form, but it was unclear to me which one I should use.Thank y

I am using recaptcha Enterprise Edition, but recently found a number of invalid evaluations, including browser_error and invalid_reason_unspecified, which together account for about 20% of total requests, up until this point, invalid evaluations were only about 2%, please tell me what to do

 I have this page where the user sign in and we use the recaptcha v3 token. The flow works on all browsers but the instagram browser (the one that opens links from stories). I get the `BrowserError` only when opening a link from instagram story.A token is generated, but for some reason the backend returns it as invalid token.  (no errors is caught by window.onerror either).Invalid token length is always 1026 charactersValid token length is around 850 charactersThoughts? 

Hey team,Our website was integrated with Google reCAPTCHA Enterprise. Recently we have found that there are a lot of abnormal token formats and a lot of users are being blocked.I want to confirm that our Google reCAPTCHA Enterprise will produce tokens in how many kinds of formats?Format:03A**** This length is about 2,200HF*** This length is about 280

Hi I'm a user of Enterprise reCaptcha and considering lowering(?) the level of ChallengeSecurityPreference from "Balance" to "Usability".I can not find any detail especially related toHow you determine which traffic is risky per each enum value; as this is not from the score-based reCaptcha and also want to understand what is the difference, too. (Such as v1 uses this many factors but v2, score-based uses this many factors....)How much increase of risk we have to expect with this change (more chance of bot attack?)And want to know if anyone from reCaptcha team can help with it.Thanks in advance.

While testing a mobile app in the staging environment against a test reCAPTCHA iOS key we got this error response when attempting to initialize: Only one site key can be used per runtime. The site key you provided **** is different than ****In particular, we are sending the staging site key but it is saying it doesn't match the production site key. I can't find any documentation regarding this but I suspect that the reCAPTCHA SDK sends along the application's ID (iOS bundle or Android APK package name) and if there is already an associated site key that has been used for it only that site key is allowed to be used by that application. This would mean that to successfully use test keys in lower environments we are forced to build variants of the applications for that purpose, which could be identified as distinct from the production version of the applications.Is this correct? Moreover, does this apply to web applications as well owing to the origin domain of calls to ini