Recaptcha

Google reCAPTCHA checks hosted authentication flows before Authdog issues a session or a one-time code. Configure it per environment. If Cloudflare Turnstile is also enabled for the same flow, reCAPTCHA is the one that runs.

Create the key

1. Create a reCAPTCHA key for every domain that serves your Authdog pages, including any custom domain.
2. Pick the version you will select in Authdog. Keys created in Google Cloud are Enterprise.
3. Copy the site key and the secret. For Enterprise, use the legacy secret key from the Integration tab (the siteverify secret).

Enable the add-on

In the Authdog console:

1. Select the project and environment.
2. Open Authentication > Add-ons.
3. Select Google reCAPTCHA.
4. Enter the Site key and the Secret key. The secret is write-only. Leave it blank on a later edit to keep the stored value.
5. Set Version to the key you created.
6. For v3 or Enterprise, set Min score. The default is 0.5. Scores below it are rejected. v2 ignores this field.
7. Select the flows to protect. Selecting none protects all of them.
8. Enable the add-on and save.

Magic link, one-time code, and MFA verification have no room for a checkbox. They need v3 or Enterprise. A v2 key on those flows does nothing, and the request continues without a token.

A version mismatch makes Google reject the token. The check then fails closed and the user sees a verification error.

Roll out

1. Configure development first and complete a real sign-up.
2. Start with sign-up, waitlist, and password reset.
3. Add sign-in, then magic link and one-time codes, once real traffic looks healthy.
4. Repeat in production with production keys. Keys do not copy between environments.

Related