reCAPTCHA keys overview

This document provides an overview of reCAPTCHA keys (also known as keys).

A reCAPTCHA key is a unique, case-sensitive string of 40 characters that needs to be installed on web pages, in mobile applications, or at the WAF layer to integrate reCAPTCHA.

A reCAPTCHA key returns a score for each request, which is based on the user interactions with your site or application. By interpreting these scores, you can take appropriate actions for your site or application, such as allowing or blocking users.

Example reCAPTCHA key: 6Lcm3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5mfX

reCAPTCHA keys can have one of the following integration types:

  • SCORE (legacy v3): Returns risk scores. It doesn't display the I'm not a robot checkbox and never shows CAPTCHA challenges.
  • CHECKBOX (legacy v2 Checkbox): Displays the I'm not a robot checkbox and might show CAPTCHA challenges after the checkbox is selected.
  • POLICY_BASED_CHALLENGE: Triggers CAPTCHA challenges based on a score threshold and challenge difficulty.
  • INVISIBLE (legacy v2 Invisible): Doesn't display the I'm not a robot checkbox, but might show CAPTCHA challenges after risk analysis.
  • Universal (Preview): Uses Policy Engine to configure automatic token attachment (AutoExecute) and custom rules for triggering CAPTCHA challenges.

To check which version your existing key uses in the Google Cloud console or to find your site key and secret key for third-party CMS plugins (such as WordPress or Shopify), see Reconcile Admin Console and Google Cloud console terminology.

The following table lists reCAPTCHA keys that are supported for each platform:
Platform Description Supported keys Challenge type
web For integration on web pages. Score-based keys SCORE
Checkbox keys CHECKBOX
Policy-based challenge keys POLICY_BASED_CHALLENGE
mobile For integration with Android and iOS apps. reCAPTCHA keys for Android SCORE
reCAPTCHA keys for iOS SCORE
WAF For web pages and APIs served through WAF or Edge compute servers. action-token keys SCORE and CHECKBOX
session-token keys SCORE
challenge-page keys INVISIBLE
API For integration with APIs or clients like IoT devices that do not support the reCAPTCHA JavaScript or mobile SDKs. express keys SCORE

What's next