> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raykoi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google reCAPTCHA v3

> Get a site key and secret key from Google, then connect it to Raykoi.

<Info>
  CAPTCHA — bring-your-own-keys or [Managed](/essentials/pro-features/managed-captcha) — requires the **Starter plan or above**. Toggling it on below a Starter plan returns a `403`.
</Info>

<Warning>
  Raykoi only supports **v3** — the invisible, score-based version. v2 (the "I'm not a robot" checkbox) isn't supported; use [Turnstile](/essentials/captcha/turnstile) or [hCaptcha](/essentials/captcha/hcaptcha) if you specifically want a visible checkbox challenge.
</Warning>

<Steps>
  <Step title="Open the reCAPTCHA admin console">
    Go to [google.com/recaptcha/admin/create](https://www.google.com/recaptcha/admin/create), signed in with the Google account you want to own this site.
  </Step>

  <Step title="Register a site">
    Give it a label (for your own reference), select **reCAPTCHA v3**, and enter the domain(s) it'll run on.
  </Step>

  <Step title="Accept the terms and submit">
    Accept the reCAPTCHA Terms of Service, then click **Submit**.
  </Step>

  <Step title="Copy your keys">
    The next page shows your **Site Key** and **Secret Key**.

    <Warning>
      The Secret Key authenticates server-side verification calls — never put it in client-side code. Only the Site Key belongs in your frontend (and Raykoi doesn't even need that from you directly — see below).
    </Warning>
  </Step>

  <Step title="Connect it to Raykoi">
    In your form's **Spam Protection** settings, choose **reCAPTCHA**, and paste in both keys. Raykoi stores the secret server-side and resolves the site key to your frontend automatically via [Get a Form's Schema](/api-reference/get-form-schema)'s `captcha` field — you never hardcode either value into your integration.
  </Step>
</Steps>

## About the score

reCAPTCHA v3 never blocks a visitor itself — it returns a score from 0.0 (very likely a bot) to 1.0 (very likely human). Raykoi maps a low score onto the same `captchaFailed` signal a v2/Turnstile/hCaptcha rejection produces, which alone is enough to block the submission outright — it's the one signal that never needs corroborating evidence from anything else.

## Verifying it's working

Submit a test entry through your actual integration. If the token never reaches Raykoi (check the **Activity** tab or your browser's network inspector for a `captcha_token` in the request body), the most common cause is the widget script being blocked — an ad blocker, a strict Content Security Policy, or a domain mismatch between what you entered in step 2 and where the form is actually embedded.