Skip to content
RevokeGPTRevokeGPTRevokeGPT docs

Migrate from reCAPTCHA Enterprise

reCAPTCHA Enterprise is a Google product and RevokeGPT is not affiliated with Google; the name is used here only to describe what you swap. A score integration works after changing the script URL, the keys and the server calls.

Client

Section titled “Client”
Google RevokeGPT
https://www.google.com/recaptcha/enterprise.js https://js.revokegpt.com/recaptcha/enterprise.js
grecaptcha.enterprise.execute(key, { action }) The same call, with your rgpk_... key

Create a score site: a score site never shows a puzzle, so your server decides. Remove Google’s script from pages that load ours; the two must not run on one page.

Server

Section titled “Server”

You can keep calling the compatible siteverify (https://api.revokegpt.com/recaptcha/api/siteverify), or use assessments, which take the same shape of request:

Enterprise RevokeGPT
projects.assessments.create POST /v1/assessments (createAssessment in the SDKs)
event.token, event.expectedAction token, expectedAction
tokenProperties.valid, invalidReason The same: an invalid token is a 200 with valid: false and score 0
riskAnalysis.score, riskAnalysis.reasons The same fields
projects.assessments.annotate POST /v1/assessments/{id}:annotate (annotate)
accountDefenderAssessment accountDefenderAssessment (Pro plan and above; account protection)
accountVerification (email) accountVerification (email MFA)
fraudPreventionAssessment Beta (payment fraud)
Authentication with a Google API key or service account Authorization: Bearer rgsk_... (your secret key)

What does not map

Section titled “What does not map”
  • No Google Cloud project, API key or service account. You use your site’s secret key.
  • SMS verification. A phoneNumber endpoint in accountVerification is accepted by the schema and answered 403 feature-disabled; we send no SMS.
  • Account verification codes are emailed and a session lives 600 seconds, not 15 minutes. challengeAccount is the widget call that runs the step. The parameter names RevokeGPT’s own client uses for it (requestToken, languageCode) have not been checked against Google’s challengeAccount parameter names; if your page passes Google-specific options, test it and report any that differ.
  • Reasons. RevokeGPT’s reasons are its own list (AUTOMATION, DATACENTER_IP, and so on; see scores and reason codes), not Google’s. Do not branch on Google’s reason names.
  • Tokens are bound to the hostname they were issued for and verify once.
  • WAF, mobile and other Enterprise products are not part of this mapping.

Checklist

Section titled “Checklist”
  1. Create a score site; add allowed domains.
  2. Swap the script URL and key; remove Google’s script.
  3. Swap the server call (compatible siteverify or createAssessment) and the secret.
  4. Review every place that reads a reason code.
  5. Test a duplicate submit.