As part of registering your app in the Firebase console to use the reCAPTCHA Enterprise provider, you need to provide a reCAPTCHA key for your app. App Check uses ***score-based*** reCAPTCHA keys, which makes it invisible to users. This means that the reCAPTCHA Enterprise provider won't require users to solve a challenge at any time. This page describes how to create these score-based keys for use with the following platforms: [web](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#web), [Android](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#android), and [Apple](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#apple). You can also find more detailed instructions in the reCAPTCHA Enterprise documentation for [web apps](https://docs.cloud.google.com/recaptcha/docs/create-key-website) and [mobile apps](https://docs.cloud.google.com/recaptcha/docs/create-key-mobile). For Flutter , you can follow the instructions for the platforms that your project targets. ## Before you begin Review these requirements and recommendations before creating score-based reCAPTCHA keys for apps on the following platforms: [Web](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#web), [Android](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#android), and [Apple](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt#apple). ### Required IAM permissions Make sure that you have the following IAM role: *reCAPTCHA Enterprise Admin* (`roles/recaptchaenterprise.admin`). ### General recommendations There's no limit on the number of reCAPTCHA keys that you can create for a Firebase project. Here are general recommendations for creating reCAPTCHA keys for common setups for Firebase projects: - Create one key for each of your registered Firebase Apps. For example: - If you have an iOS, Android, and web app that share the same Firebase project, then your project should have three keys. - If you have multiple apps of the same platform that share the same Firebase project, then your project should have a key for each of those apps. - Create separate keys for development, staging, and production apps (each of these variants should already be using a [separate Firebase project](https://firebase.google.com/docs/projects/dev-workflows/general-best-practices.md.txt)). Otherwise, you risk polluting reCAPTCHA Enterprise risk analysis with data from your non-production environments. ## Web To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API. For websites, the reCAPTCHA key is unique to the domains and subdomains that you specify. You can specify more than one domain if you serve your website from multiple domains. If you specify a domain (for example, `examplepetstore.com`), you don't need to specify its subdomains (for example, `subdomain.examplepetstore.com`). > [!IMPORTANT] > **Important:** Never add `localhost` as a domain to a reCAPTCHA key that is used for (or is going to be used for) production. For testing and development, instead of using `localhost`, create a separate reCAPTCHA test key or use the [App Check *debug provider*](https://firebase.google.com/docs/app-check/web/debug-provider.md.txt). ### Google Cloud console 1. In the Google Cloud console, go to the [**Fraud Defense** page](https://console.cloud.google.com/security/recaptcha) (where you set up reCAPTCHA keys). 2. Make sure that you're in the correct project (see the project picker at the top of the screen). 3. Click **Create key**. 4. In the **Display name** field, enter a display name for the key. 5. For the **Application type** , select **Web**. 6. To protect the key for your domain and subdomains, ensure that the toggle for **Disable domain verification** is turned off. > [!IMPORTANT] > **Important:** Disabling domain verification is a security risk because there aren't restrictions on the site, so your key can be accessed and used by anyone. 7. In the **Domain list** section, do the following: 1. Click **Add a domain**. 2. In the **Domain** field, enter the name of your domain. 3. *(Optional)* To add an additional domain, click **Add a domain** and enter another domain name. - App Check does ***not*** support web apps that serve on more than 250 domains. - Never add `localhost` as a domain to a reCAPTCHA key that is used for (or is going to be used for) production. 8. *(Optional)* If you're creating a test key for your *non-production* app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following: 1. Click **Next Step (optional)** to access the **Additional settings** step. 2. Do ***not*** turn on the toggle for **Will you use challenges?**. 3. Turn on the toggle for **Are you creating this key for testing purposes only?** , then use the **Set score** slider to specify a score between 0 to 1.0. > [!IMPORTANT] > **Important:** Do *not* commit your test key to a public repository, and do *not* ship the key in builds of your app. > > Also, you can only use test keys with *non-production* versions of your app. If you need to do local development and testing for a *production* build of your app that uses a production reCAPTCHA key, then you need to use the [App Check *debug provider*](https://firebase.google.com/docs/app-check/web/debug-provider.md.txt) instead. 9. Click **Create key**. The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console. ### gcloud CLI To create a score-based key using the gcloud CLI, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-website#create-recaptcha-key-gcloud). ### REST To create a score-based key using the REST API, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-website#create-recaptcha-key-REST). ## Android To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API. ### Google Cloud console 1. In the Google Cloud console, go to the [**Fraud Defense** page](https://console.cloud.google.com/security/recaptcha) (where you set up reCAPTCHA keys). 2. Make sure that you're in the correct project (see the project picker at the top of the screen). 3. Click **Create key**. 4. In the **Display name** field, enter a display name for the key. 5. For the **Application type** , select **Android**. 6. To protect the key for your Android app, ensure that the toggle for **Disable package name verification** is turned off. > [!IMPORTANT] > **Important:** Disabling package name verification is a security risk because there aren't restrictions on the app, so your key can be accessed and used by anyone. 7. In the **Android package** list section, do the following: 1. Click **Add Android package**. 2. In the **Android package** field, enter your Android app's package name (for example, `com.example.my_app`). - Make sure that you enter the same package name that you provided when you created your Firebase Android App in your Firebase project. The package name value is case-sensitive. - For App Check, each package name can only correspond to a single reCAPTCHA key. 8. If you want to create a key for an app that is available on other app stores in addition to the Google Play Store, turn on the toggle for **Support applications distributed outside of the Google Play Store**. 9. *(Optional)* If you're creating a test key for your *non-production* app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following: 1. Click **Next Step (optional)** to access the **Additional settings** step. 2. Do ***not*** turn on the toggle for **Will you use challenges?**. 3. Turn on the toggle for **Are you creating this key for testing purposes only?** , then use the **Set score** slider to specify a score between 0 to 1.0. > [!IMPORTANT] > **Important:** Do *not* commit your test key to a public repository, and do *not* ship the key in builds of your app. > > Also, you can only use test keys with *non-production* versions of your app. If you need to do local development and testing for a *production* build of your app that uses a production reCAPTCHA key, then you need to use the [App Check *debug provider*](https://firebase.google.com/docs/app-check/android/debug-provider.md.txt) instead. 10. Click **Create key**. The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console. ### gcloud CLI To create a score-based key using the gcloud CLI, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-mobile#create-recaptcha-key-gcloud%20(Android)). ### REST To create a score-based key using the REST API, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-mobile#create-recaptcha-key-REST%20(Android)). ## Apple platforms To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API. ### Google Cloud console 1. In the Google Cloud console, go to the [**Fraud Defense** page](https://console.cloud.google.com/security/recaptcha) (where you set up reCAPTCHA keys). 2. Make sure that you're in the correct project (see the project picker at the top of the screen). 3. Click **Create key**. 4. In the **Display name** field, enter a display name for the key. 5. For the **Application type** , select **iOS**. 6. To protect the key for your Apple platforms app, ensure that the toggle for **Disable bundle ID verification** is turned off. > [!IMPORTANT] > **Important:** Disabling bundle ID verification is a security risk because there aren't restrictions on the app, so your key can be accessed and used by anyone. 7. In the **iOS bundle ID list** list section, do the following: 1. Click **Add iOS bundle ID**. 2. In the **Bundle ID** field, enter your app's bundle ID (for example, `com.example.my_app`). - Make sure that you enter the same bundle ID that you provided when you created your Firebase Apple App in your Firebase project. The bundle ID value is case-sensitive. - For App Check, each bundle ID can only correspond to a single reCAPTCHA key. 3. *(Optional)* To add an additional bundle ID, click **Add iOS bundle ID** and enter another bundle ID. 8. Provide **Apple Developer settings**. We *strongly* recommend providing this data because it lets reCAPTCHA Enterprise provide more accurate risk scores for your traffic. Enter the following information: - **Private key (.p8)**: This is generated in the Apple Developer Center under Certificates, Identifiers \& Profiles. - **Key identifier**: The Apple developer key identifier (10-character string). - **Team ID**: The Apple team ID (10-character string) owning the provisioning profile that is used to build your application. 9. *(Optional)* If you're creating a test key for your *non-production* app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following: 1. Click **Next Step (optional)** to access the **Additional settings** step. 2. Do ***not*** turn on the toggle for **Will you use challenges?**. 3. Turn on the toggle for **Are you creating this key for testing purposes only?** , then use the **Set score** slider to specify a score between 0 to 1.0. > [!IMPORTANT] > **Important:** Do *not* commit your test key to a public repository, and do *not* ship the key in builds of your app. > > Also, you can only use test keys with *non-production* versions of your app. If you need to do local development and testing for a *production* build of your app that uses a production reCAPTCHA key, then you need to use the [App Check *debug provider*](https://firebase.google.com/docs/app-check/ios/debug-provider.md.txt) instead. 10. Click **Create key**. The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console. ### gcloud CLI To create a score-based key using the gcloud CLI, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-mobile#create-recaptcha-key-gcloud%20(iOS)). ### REST To create a score-based key using the REST API, follow the instructions in the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/create-key-mobile#create-recaptcha-key-REST%20(iOS)).