Reconcile Admin Console and Google Cloud console terminology

This document describes how to identify your reCAPTCHA key version (v2 or v3), map legacy reCAPTCHA Admin console terminology to the Google Cloud console, and retrieve the site keys and secret keys required by content management system (CMS) platforms and third-party plugins, such as WordPress or Shopify integrations.

Map legacy terminology to the Google Cloud console

If you manage your keys only in the reCAPTCHA Admin console, you're using reCAPTCHA Classic. If you manage your keys on the Google Cloud Fraud Defense page in the Google Cloud console, you're using Fraud Defense. Both consoles support v2 and v3 website keys.

Many CMS platforms and plugins refer to reCAPTCHA keys using legacy version numbers, such as v2 Checkbox, v2 Invisible, and v3. The Google Cloud console uses platform-based descriptors instead of version numbers.

The following table maps legacy CMS and Admin Console terminology to the Google Cloud console terminology:

CMS or Admin Console terminology Google Cloud console (Platform details) Edit key (Type field) Verification mechanism and CMS compatibility
Score based (v3) Website • score Website • Score Frictionless, score-based verification. Use for CMS plugins that require reCAPTCHA v3.
Challenge (v2) Website • checkbox Website • Checkbox challenge Requires the user to select an "I'm not a robot" checkbox. Use for CMS plugins that require reCAPTCHA v2 Checkbox.
Invisible (v2) Website • invisible Website • Invisible integration Analyzes risk in the background and might show a challenge. Use for CMS plugins that require reCAPTCHA v2 Invisible.
N/A Website • policy-based challenge Website • Policy-based challenge Triggers challenges based on a configured score threshold. Requires a custom CreateAssessment integration.
N/A iOS iOS app iOS mobile key without challenge.
N/A Android Android app Android mobile key without challenge.

View your key version in the Google Cloud console

To view the version of your key in the Google Cloud console, do the following:

  1. In the Google Cloud console, go to the Fraud Defense page.

    Go to Fraud Defense

  2. Select the Keys tab.

  3. If your keys are in Cards view, switch to Table view.

  4. Check the Platform details column for your key. For example, Website • score corresponds to v3, and Website • checkbox corresponds to v2 Checkbox.

  5. Optional. In Cards view, click Key details on a key card, and then select Edit key. The Type field shows the key configuration, such as Website • Score for v3 or Website • Checkbox challenge for v2 Checkbox.

Find the site key and secret key

Third-party plugins and CMS platforms often require a site key and a secret key for reCAPTCHA integration:

  • Site key: In the Google Cloud console, the Key ID corresponds to the site key.
  • Secret key: The Google Cloud console doesn't display the secret key by default because Google Cloud authentication typically uses API keys or Identity and Access Management roles. However, you can retrieve the legacy secret key for plugins that require it. Some third-party libraries or documentation might refer to the legacy secret key as a private key.

Retrieve the secret key in the Google Cloud console

To retrieve the site key and secret key, do the following:

  1. In the Google Cloud console, go to the Fraud Defense page.

    Go to Fraud Defense

  2. Select the Keys tab.

  3. In the reCAPTCHA Keys section, go to the key that you need the secret key for:

    • If you're in the Cards view, click Key details on the key card. The Key ID is displayed at the top of the page.
    • If you're in the Table view, the Key ID is visible in the table. Click the key to go to its details page.

  4. Copy the Key ID displayed at the top of the page. This value is your site key.

  5. Go to the Integration tab.

  6. Depending on the key's status, do one of the following:

    • If the key is configured for legacy use, click Use legacy key.
    • If the key isn't integrated with a legacy service, click Integrate with a third-party service or plugin.

  7. A dialog appears with your secret key. Copy this value securely. Treat this secret as sensitive data.

    Alternatively, on the Key details page, click Edit key, and then click Reveal next to the Secret key field.

Integrate with WordPress, Shopify, or other CMS platforms

If you use a website builder, ecommerce platform, or CMS plugin, the platform or plugin loads the reCAPTCHA script and verifies user tokens automatically. You don't need to install reCAPTCHA client libraries or write custom backend code.

To configure reCAPTCHA in a CMS or third-party plugin, do the following:

  1. Check the reCAPTCHA version required by your CMS or plugin: Open the reCAPTCHA integration settings in your CMS or plugin and check which key type it supports (typically reCAPTCHA v3 or reCAPTCHA v2 Checkbox).

  2. Select or create a matching key:

    • If you already have a key, view your key version to confirm that it matches the version selected in your plugin (Website • score for v3, or Website • checkbox for v2 Checkbox).
    • If you need a new key, create a key for your website that matches the required version, and add your website domain (for example, example.com) to the key's Domain list.

  3. Copy your site key and legacy secret key: Follow the steps in Retrieve the secret key in the Google Cloud console to get your Key ID (site key) and secret key.

  4. Enter the keys in your CMS or plugin settings:

    • Paste the Key ID into the Site key field.
    • Paste the secret key into the Secret key (or Private key) field, and then save your settings.

Integrate custom websites using assessments

The CreateAssessment method provides detailed risk analysis and reason codes, and enables access to advanced Fraud Defense features. You can call the CreateAssessment method using the reCAPTCHA client libraries or the REST API.

For more information, see Create an assessment for your website.

Legacy SiteVerify method

Although we recommend the CreateAssessment method for new and custom integrations, some existing systems or third-party plugins still rely on the legacy SiteVerify method. This method requires a secret key associated with your reCAPTCHA key.

If you need to integrate with a system that requires the legacy SiteVerify API, see Verify user response tokens with legacy SiteVerify.

What's next