Create score-based reCAPTCHA keys

As part of registering your app in the Firebase console to use the reCAPTCHA Enterprise provider, you need to provide a reCAPTCHA key for your app. App Check uses score-based reCAPTCHA keys, which makes it invisible to users. This means that the reCAPTCHA Enterprise provider won't require users to solve a challenge at any time.

This page describes how to create these score-based keys for use with the following platforms: web, Android, and Apple. You can also find more detailed instructions in the reCAPTCHA Enterprise documentation for web apps and mobile apps.

For Flutter , you can follow the instructions for the platforms that your project targets.

Before you begin

Review these requirements and recommendations before creating score-based reCAPTCHA keys for apps on the following platforms: Web, Android, and Apple.

Required IAM permissions

Make sure that you have the following IAM role: reCAPTCHA Enterprise Admin (roles/recaptchaenterprise.admin).

General recommendations

There's no limit on the number of reCAPTCHA keys that you can create for a Firebase project. Here are general recommendations for creating reCAPTCHA keys for common setups for Firebase projects:

  • Create one key for each of your registered Firebase Apps. For example:

    • If you have an iOS, Android, and web app that share the same Firebase project, then your project should have three keys.

    • If you have multiple apps of the same platform that share the same Firebase project, then your project should have a key for each of those apps.

  • Create separate keys for development, staging, and production apps (each of these variants should already be using a separate Firebase project). Otherwise, you risk polluting reCAPTCHA Enterprise risk analysis with data from your non-production environments.

Web

To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API.

For websites, the reCAPTCHA key is unique to the domains and subdomains that you specify. You can specify more than one domain if you serve your website from multiple domains. If you specify a domain (for example, examplepetstore.com), you don't need to specify its subdomains (for example, subdomain.examplepetstore.com).

Google Cloud console

  1. In the Google Cloud console, go to the Fraud Defense page (where you set up reCAPTCHA keys).

  2. Make sure that you're in the correct project (see the project picker at the top of the screen).

  3. Click Create key.

  4. In the Display name field, enter a display name for the key.

  5. For the Application type, select Web.

  6. To protect the key for your domain and subdomains, ensure that the toggle for Disable domain verification is turned off.

  7. In the Domain list section, do the following:

    1. Click Add a domain.

    2. In the Domain field, enter the name of your domain.

    3. (Optional) To add an additional domain, click Add a domain and enter another domain name.

      • App Check does not support web apps that serve on more than 250 domains.

      • Never add localhost as a domain to a reCAPTCHA key that is used for (or is going to be used for) production.

  8. (Optional) If you're creating a test key for your non-production app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following:

    1. Click Next Step (optional) to access the Additional settings step.

    2. Do not turn on the toggle for Will you use challenges?.

    3. Turn on the toggle for Are you creating this key for testing purposes only?, then use the Set score slider to specify a score between 0 to 1.0.

  9. Click Create key.

The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console.

gcloud CLI

To create a score-based key using the gcloud CLI, follow the instructions in the reCAPTCHA Enterprise documentation.

REST

To create a score-based key using the REST API, follow the instructions in the reCAPTCHA Enterprise documentation.

Android

To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API.

Google Cloud console

  1. In the Google Cloud console, go to the Fraud Defense page (where you set up reCAPTCHA keys).

  2. Make sure that you're in the correct project (see the project picker at the top of the screen).

  3. Click Create key.

  4. In the Display name field, enter a display name for the key.

  5. For the Application type, select Android.

  6. To protect the key for your Android app, ensure that the toggle for Disable package name verification is turned off.

  7. In the Android package list section, do the following:

    1. Click Add Android package.

    2. In the Android package field, enter your Android app's package name (for example, com.example.my_app).

      • Make sure that you enter the same package name that you provided when you created your Firebase Android App in your Firebase project. The package name value is case-sensitive.

      • For App Check, each package name can only correspond to a single reCAPTCHA key.

  8. If you want to create a key for an app that is available on other app stores in addition to the Google Play Store, turn on the toggle for Support applications distributed outside of the Google Play Store.

  9. (Optional) If you're creating a test key for your non-production app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following:

    1. Click Next Step (optional) to access the Additional settings step.

    2. Do not turn on the toggle for Will you use challenges?.

    3. Turn on the toggle for Are you creating this key for testing purposes only?, then use the Set score slider to specify a score between 0 to 1.0.

  10. Click Create key.

The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console.

gcloud CLI

To create a score-based key using the gcloud CLI, follow the instructions in the reCAPTCHA Enterprise documentation.

REST

To create a score-based key using the REST API, follow the instructions in the reCAPTCHA Enterprise documentation.

Apple platforms

To create a score-based key, you can use the Google Cloud console, gcloud CLI, or REST API.

Google Cloud console

  1. In the Google Cloud console, go to the Fraud Defense page (where you set up reCAPTCHA keys).

  2. Make sure that you're in the correct project (see the project picker at the top of the screen).

  3. Click Create key.

  4. In the Display name field, enter a display name for the key.

  5. For the Application type, select iOS.

  6. To protect the key for your Apple platforms app, ensure that the toggle for Disable bundle ID verification is turned off.

  7. In the iOS bundle ID list list section, do the following:

    1. Click Add iOS bundle ID.

    2. In the Bundle ID field, enter your app's bundle ID (for example, com.example.my_app).

      • Make sure that you enter the same bundle ID that you provided when you created your Firebase Apple App in your Firebase project. The bundle ID value is case-sensitive.

      • For App Check, each bundle ID can only correspond to a single reCAPTCHA key.

    3. (Optional) To add an additional bundle ID, click Add iOS bundle ID and enter another bundle ID.

  8. Provide Apple Developer settings.

    We strongly recommend providing this data because it lets reCAPTCHA Enterprise provide more accurate risk scores for your traffic.

    Enter the following information:

    • Private key (.p8): This is generated in the Apple Developer Center under Certificates, Identifiers & Profiles.

    • Key identifier: The Apple developer key identifier (10-character string).

    • Team ID: The Apple team ID (10-character string) owning the provisioning profile that is used to build your application.

  9. (Optional) If you're creating a test key for your non-production app and if you want to specify a score that you want the key to return when any assessments are created for it, do the following:

    1. Click Next Step (optional) to access the Additional settings step.

    2. Do not turn on the toggle for Will you use challenges?.

    3. Turn on the toggle for Are you creating this key for testing purposes only?, then use the Set score slider to specify a score between 0 to 1.0.

  10. Click Create key.

The newly created key is listed on the reCAPTCHA keys page in the Google Cloud console.

gcloud CLI

To create a score-based key using the gcloud CLI, follow the instructions in the reCAPTCHA Enterprise documentation.

REST

To create a score-based key using the REST API, follow the instructions in the reCAPTCHA Enterprise documentation.