Skip to content
capzy
Login

reCAPTCHA v3

Match the action. Request the score your flow needs. Collect the public key and the exact action together. v3 runs when the page executes an action, so the action name matters as much as the key.

Get the integration code Try the demo
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "ReCaptchaV3TaskProxyLess",
    "websiteURL": "https://example.com/login",
    "websiteKey": "6LcR_RsTAAAAADHmXXPJh-Lr7Mz4aCezAo3vKWiq",
    "pageAction": "login"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Site key + page action + score targetProxyless or your own proxygRecaptchaResponse + user-agent

Read the key and action together.

Collect the public key and the exact action together. v3 runs when the page executes an action, so the action name matters as much as the key.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Read grecaptcha.execute for the action you need.

  1. In Network, find api.js and inspect its render query parameter for the public key. If render is explicit, search Sources for the execute call instead.
  2. Search Sources for grecaptcha.execute and trigger the relevant form/action. Copy its key into websiteKey and options.action into pageAction.
  3. Copy the full page URL into websiteURL. Preserve the action's exact spelling and capitalization.
Input collection example - replace illustrative values
grecaptcha.execute("YOUR_PUBLIC_SITE_KEY", {
  action: "login"
}).then(onCaptchaComplete);
// task.websiteKey = first argument
// task.pageAction = options.action

The action is configured by the site. Do not infer it from the URL or the button label.

Provider integration documentation
How reCAPTCHA v3 works

reCAPTCHA v3 is Google's invisible captcha that runs in the background without user interaction. Instead of showing a challenge, it analyzes user behavior and returns a risk score between 0.0 (bot) and 1.0 (human). Websites set a threshold (typically 0.3-0.7) and block requests below it. Unlike v2, there's no checkbox or image puzzle — the captcha is completely invisible. This makes it harder to detect but also harder to bypass, since you need to produce a token that results in a high enough score. reCAPTCHA v3 Enterprise is the same scoring model loaded from /recaptcha/enterprise.js and executed through grecaptcha.enterprise.execute(). Google only accepts a token for an Enterprise sitekey when it was minted through the Enterprise flow, so select the Enterprise variant on this page (ReCaptchaV3EnterpriseTaskProxyLess, or ReCaptchaV3EnterpriseTask with your proxy) whenever the page loads enterprise.js.

Capzy's proprietary solver returns valid reCAPTCHA v3 tokens. Final score is determined by Google when your backend calls siteverify — the score depends heavily on the IP that makes the request, so for the highest scores use ReCaptchaV3Task with your own proxy. Standard and Enterprise sitekeys use separate task types; pick the matching request variant below and the examples update to the right type.

  • AI-powered — no human workers needed
  • Flat $0.0015 per solve — no hidden tiers
  • Optional /reportScore feedback loop — share Google's verified score and see your quality on the dashboard
  • Enterprise sitekeys via ReCaptchaV3EnterpriseTaskProxyLess / ReCaptchaV3EnterpriseTask, with enterprisePayload support
  • Fast — average 8-9 second solve time
  • pageAction support — matches the site's expected action
  • 99.9% uptime — redundant solver infrastructure

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Standard v3. The page loads /recaptcha/api.js?render=SITEKEY and calls grecaptcha.execute(SITEKEY, { action }). Copy that action into pageAction. Proxy mode sends ReCaptchaV3Task through your own exit for a higher score.

Request authentication

Required task inputs

Optional context

websiteURL

stringRequired

The URL of the page where reCAPTCHA v3 is loaded

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide
Example valuehttps://example.com/login
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "ReCaptchaV3TaskProxyLess",
    "websiteURL": "https://example.com/login",
    "websiteKey": "6LcR_RsTAAAAADHmXXPJh-Lr7Mz4aCezAo3vKWiq",
    "pageAction": "login"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Forward solution.gRecaptchaResponse to the action's existing token field or request body. Preserve solution.userAgent when your validation flow binds identity; inspect expireTime and validate the action and score on your backend.

ReCaptchaV3TaskProxyLess · $1.00 / 1,000
solve_recaptcha_v3.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"ReCaptchaV3TaskProxyLess\",\"websiteURL\":\"https://example.com/login\",\"websiteKey\":\"6LcR_RsTAAAAADHmXXPJh-Lr7Mz4aCezAo3vKWiq\",\"pageAction\":\"login\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

gRecaptchaResponse + user-agent

Forward solution.gRecaptchaResponse to the action's existing token field or request body. Preserve solution.userAgent when your validation flow binds identity; inspect expireTime and validate the action and score on your backend.

string
The solved token — submit this in the g-recaptcha-response field or the callback parameter
string
The User-Agent string the solver used to mint the token. Submit it from the same UA on your backend if Google's siteverify enforces UA binding.
number
Unix milliseconds when the token expires (issued time + 120s — Google v3 tokens have a 2-minute lifetime).
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "gRecaptchaResponse": "03AGdBq25...<long v3 token, 2-minute lifetime>...",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
    "expireTime": 1735689720000
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Use the result

Forward solution.gRecaptchaResponse to the action's existing token field or request body. Preserve solution.userAgent when your validation flow binds identity; inspect expireTime and validate the action and score on your backend.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python

# Step 3: Use the result — paste the token into g-recaptcha-response
token = result["solution"]["gRecaptchaResponse"]
# Browser side: document.querySelector('textarea[name="g-recaptcha-response"]').value = token
# Or include it in your form POST:
resp = requests.post("https://target.example.com/login", data={
    "username": "...",
    "password": "...",
    "g-recaptcha-response": token,
})
print(resp.status_code)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

What score will I get?

Score is decided by Google's backend when your server calls siteverify. The biggest driver is the IP that fetches /recaptcha/api2/* — the ProxyLess path typically scores 0.3-0.5; for 0.7-0.9 use ReCaptchaV3Task with your own proxy. We can't guarantee a specific score because we never see what Google returns to your siteverify call.

Do I need to provide the pageAction?

It's recommended. The pageAction must match what the site's JavaScript passes to grecaptcha.execute(). If it doesn't match, the score will be lower.

How do I know if the site uses v3 Enterprise?

Check the script and the execute call. Enterprise pages load /recaptcha/enterprise.js and call grecaptcha.enterprise.execute(); standard v3 pages load /recaptcha/api.js?render=SITEKEY and call grecaptcha.execute(). Search the page's Sources for 'enterprise.execute' to be sure.

How do I solve an Enterprise sitekey?

Select the Enterprise variant above and send ReCaptchaV3EnterpriseTaskProxyLess, or ReCaptchaV3EnterpriseTask with your own proxy. The parameters are the same as standard v3: websiteURL, websiteKey and pageAction. There is no isEnterprise flag; the task type is what switches the solver to enterprise.js. If the site's execute() call passes an s token or other options besides action, copy them into enterprisePayload.

How do I get a good score on Enterprise?

Enterprise risk analysis is stricter than standard v3 on two things you control: the action and the IP. Use the exact action string from grecaptcha.enterprise.execute() as pageAction, and send ReCaptchaV3EnterpriseTask with a clean residential proxy that you also use to submit the token. Keep one stable IP per site so its reputation builds up.

Can I report my verified score back to you?

Yes — call POST /reportScore with the score Google returned from siteverify. It's optional, never affects pricing, and powers the V3 quality dashboard so you can see your score distribution over time.

How do I find the sitekey?

Search the page source for 'data-sitekey', 'sitekey', or the pattern starting with '6L'. It's also visible in network requests to google.com/recaptcha.

Can I use this with Selenium/Puppeteer?

Yes. Create the task via our API, get the token, then inject it into the page using document.getElementById('g-recaptcha-response').value = token.

Is there a rate limit?

No hard rate limit. Our infrastructure auto-scales. You can send thousands of concurrent tasks.

Integration checks for reCAPTCHA v3
  • pageAction must match the site's real action. Google scores the token against the action you request — if the site calls grecaptcha.execute(sitekey, {action: 'login'}) and you send pageAction: 'verify', the score will drop. Inspect the site's JS for the exact string. We default to 'verify' only when none is provided.
  • websiteURL must be the exact page URL where reCAPTCHA loads. Domain-only URLs or wrong paths cause invalid tokens — use the full URL of the page that contains the widget.
  • Use a high-quality static residential IP for the best scores. The IP that fetches /recaptcha/api2/* is one of Google's strongest signals, so a clean residential IP you supply scores higher than a shared or datacenter ProxyLess IP. For 0.7 to 0.9 scores on strict sitekeys, send ReCaptchaV3Task with your own residential proxy, and keep one stable IP per site so its reputation builds up as you use it.
  • The task type must match the site. If the page loads /recaptcha/enterprise.js or calls grecaptcha.enterprise.execute(), send ReCaptchaV3EnterpriseTaskProxyLess or ReCaptchaV3EnterpriseTask. There is no isEnterprise flag. A standard v3 token is rejected by an Enterprise sitekey, and an Enterprise token is rejected by a standard one.

Connect reCAPTCHA v3 to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$1.00Per 1,000 solves
9.4sAverage solve time

ReCaptchaV3TaskProxyLess · Live configuration