Skip to main content
Question

Intermittent invalid-keys error from siteverify endpoint (reCAPTCHA v2 invisible)

  • March 18, 2026
  • 1 reply
  • 8 views

Brendon Vicente

Hello folks!

Hope this message finds you well :)

 

I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:

{
"success": false,
"error-codes": ["invalid-keys"]
}

 

Context

  • We are using reCAPTCHA v2 Invisible

  • Tokens are generated on the client and validated server-side using /siteverify

  • The application runs under a single domain

  • The integration has been stable and unchanged for some time

What we have verified

  • The site key and secret key are correct and consistent

  • Both keys belong to the same reCAPTCHA configuration

  • We are not rotating keys or switching environments dynamically

  • The same keys are used for all requests

  • The error is intermittent — the majority of validations succeed

Additional observations

  • The error only appears in the backend response from /siteverify

  • We could not find invalid-keys documented as a possible error code in the official documentation:
    https://developers.google.com/recaptcha/docs/verify

  • Because of this, it is unclear what exact condition triggers this error

Questions

  • What does the invalid-keys error specifically mean in the context of siteverify?

  • Under what conditions can it occur intermittently?

  • Has anyone else experienced this behavior?


Any guidance or insight would be greatly appreciated.

Thanks in advance!

1 reply

faube
Staff
Forum|alt.badge.img+7
  • Staff
  • March 19, 2026

Hi, if you are getting this error only intermittently, it may mean that an attacker is sending you tokens that they created somewhere other than your site, hoping that you will let them through.

It may also mean a misconfiguration, for example if you have multiple sites and keys, and you accidentally verify a token from from one site using a key from another site.