Migrate from reCAPTCHA v3

An unmodified reCAPTCHA v3 integration works after changing two URLs and the keys. reCAPTCHA is a Google product and RevokeGPT is not affiliated with Google; the name is used here only to describe what you swap.

1. Two URLs and the keys

Where	Google	RevokeGPT
The script (render=<site key>)	https://www.google.com/recaptcha/api.js	https://js.revokegpt.com/recaptcha/api.js
Server-side verification	https://www.google.com/recaptcha/api/siteverify	https://api.revokegpt.com/recaptcha/api/siteverify

Replace the site key in render=<key> and grecaptcha.execute(<key>, { action }) with your rgpk_... key, and the secret on your server with your rgsk_... key.

Create a score site. v3 never shows the visitor anything, and a score site returns the score however low and never a puzzle, so your server decides, as with Google. On an invisible or checkbox site a low-scoring visitor would instead see a puzzle in a modal overlay when your page calls grecaptcha.execute, which a v3 page does not expect.

2. Server swap

Keep POSTing secret and response (form-encoded or JSON). A secret in a URL is refused, any query string is refused, and so is a request that carries an Origin header (siteverify is for servers, never browsers); refusals are HTTP 200 with success: false and bad-request. The success body has Google’s field set: success, score, action, challenge_ts (RFC 3339), hostname, error-codes.

To use an SDK instead, see the quickstarts. With an SDK, verify also checks the hostname and action, and minScore is required.

Score mapping

reCAPTCHA v3	RevokeGPT
1.0 is human, 0.0 is bot	The same direction: 1.0 human, 0.0 bot
Scores in steps of 0.1	Scores in steps of 0.1
A common threshold of 0.5	Keeps its meaning on a score site
action in execute, checked on the server	The same: pass it to execute, check it on the server
A token verifies once	A token verifies once and lives 300 seconds (timeout-or-duplicate after a second use)

RevokeGPT’s /v1/siteverify additionally returns mode, reasons and cdata and rejects unknown request fields; use it when you adopt an SDK. The compatibility path ignores unknown fields such as version=php_1.3.0.

Checklist

1. Create a score site and add allowed domains.
2. Swap the script URL, site key, siteverify URL and secret.
3. Remove Google’s script from pages that load ours.
4. Allow https://js.revokegpt.com in script-src and frame-src if you have a CSP.
5. Test a duplicate submit: the second verification must fail with timeout-or-duplicate.