Hello folks!
Hope this message finds you well :)
I'm working on a production application that handles around 400k daily requests, and we are currently facing an intermittent issue with reCAPTCHA validation. Occasionally, when validating tokens using the /siteverify endpoint, we receive the following response:
{
"success": false,
"error-codes": ["invalid-keys"]
}Context
-
We are using reCAPTCHA v2 Invisible
-
Tokens are generated on the client and validated server-side using
/siteverify -
The application runs under a single domain
-
The integration has been stable and unchanged for some time
What we have verified
-
The site key and secret key are correct and consistent
-
Both keys belong to the same reCAPTCHA configuration
-
We are not rotating keys or switching environments dynamically
-
The same keys are used for all requests
-
The error is intermittent — the majority of validations succeed
Additional observations
-
The error only appears in the backend response from
/siteverify -
We could not find
invalid-keysdocumented as a possible error code in the official documentation:
https://developers.google.com/recaptcha/docs/verify -
Because of this, it is unclear what exact condition triggers this error
Questions
-
What does the
invalid-keyserror specifically mean in the context ofsiteverify? -
Under what conditions can it occur intermittently?
-
Has anyone else experienced this behavior?
Any guidance or insight would be greatly appreciated.
Thanks in advance!