Skip to content
RevokeGPTRevokeGPTRevokeGPT docs

Migrate from reCAPTCHA v2

An unmodified reCAPTCHA v2 integration (checkbox or invisible) works after changing two URLs and the keys. RevokeGPT is named here only to describe what you swap; reCAPTCHA is a Google product and RevokeGPT is not affiliated with Google.

1. The two URLs

Section titled “1. The two URLs”
Where Google RevokeGPT
The script https://www.google.com/recaptcha/api.js https://js.revokegpt.com/recaptcha/api.js
Server-side verification https://www.google.com/recaptcha/api/siteverify https://api.revokegpt.com/recaptcha/api/siteverify

Query parameters on the script URL keep their meaning: render=explicit|onload, onload=<global function name>, hl=<language>, badge=bottomright|bottomleft|inline.

2. The keys

Section titled “2. The keys”

Create a site in the dashboard, add its allowed domains, then replace the site key (data-sitekey, grecaptcha.render) with your rgpk_... key and the secret your server sends with your rgsk_... key. A token is bound to the hostname it was issued for, as in reCAPTCHA.

Choose the site mode that matches your integration: a checkbox site for v2 checkbox and an invisible site for v2 invisible. A low-scoring visitor gets a puzzle in the same place Google would show one, and your callback runs when it is passed. On these sites rely on success, not the score: a token earned by passing a puzzle keeps its honest pre-puzzle score, which is at most 0.2 with the default threshold.

The markup, grecaptcha.render, execute, ready, reset, getResponse, data-* attributes, callbacks and the g-recaptcha-response field work as with Google’s script.

3. Server swap

Section titled “3. Server swap”

Keep POSTing secret and response to siteverify, and check success. Or switch to an SDK:

Language Page
Node, Python, PHP, Go, Java Quickstarts
WordPress WordPress plugin

With an SDK, verify also checks the hostname and the action for you.

4. Checklist

Section titled “4. Checklist”
  1. Create the site in the right mode, add allowed domains, copy both keys.
  2. Swap the script URL, site key, siteverify URL and secret.
  3. Remove Google’s script from pages that load ours. The two must not run on one page: if window.grecaptcha already has a render function the shim installs nothing and logs one warning.
  4. If you have a Content Security Policy, allow https://js.revokegpt.com in script-src and frame-src.
  5. Keep verifying with POST only. Test a duplicate submit: the second verification must fail with timeout-or-duplicate.

See what differs on purpose and the score mapping.