Docly Developers
GuideUpdated 21 Oct 2026

How to setup Google reCAPTCHA

Follow this guide to create a Google reCAPTCHA token (human validation) in Docly™.

PART 1 - Create a Google site key

Open Google Cloud Console

Create a project and open

Activate reCAPTCHA Enterprise

This is done / enabled under APIs and services.

Navigate to: Security > Recaptcha enterprise

Configure a site key in Google Cloud Console

Use checkbox challenge, and add at least one domain to your list

You should also store the LEGACY key if you want to call the API to verify the tokens. Keep it in a configuration document under #/, never in code or in a screenshot.

PART 2 - Use "Google reCAPTCHA v2.0" in your API

Add reCAPTCHA HTML markup and javascript

Add reCAPTCHA field inside your form:

<form id="SignUp" data-message="Thank you, your form has been submitted.">
    <div class="form-group">
        <label>Email</label>
        <input class="form-control input-lg" name="Email" type="email" required>
    </div>
    <div class="form-group">
        <div class="g-recaptcha" id="captcha1" data-sitekey="ENTER-YOUR-SITE-KEY-HERE"></div>
    </div>
    <button class="btn btn-success btn-lg" type="submit">Sign up</button>
</form>

Remember to insert your site key where it says: "ENTER-YOUR-SITE-KEY-HERE"

Add script at the end of the page:

<script src="https://www.google.com/recaptcha/api.js" async defer></script>

This example form looks like this:

Either pass the Google reCAPTCHA value or submit the form to your apropriate API end point (default input field name is "g-recaptcha-response")

Validate reCAPTCHA in API

In order to check that the reCAPTCHA was valid you must submit the result value and code a check of this value from an API function. Your API function will call the Google API to check the reCAPTCHA result.

#/API/Example.js

/* This code checks that the reCAPTCHA token posted with the form is valid */
/* The secret key (Google calls it the legacy key) lives in #/Config, never in code */
var config = docly.getJson("#/Config") || {};

var token = form["g-recaptcha-response"];
if (token && typeof token !== "string") token = token.length > 0 ? token[0] : "";
if (!token) throw new Error("Validation failed: token not specified!");

/* httpFormPost sends the secret in the form body, not in the URL */
var result = docly.httpFormPost("https://www.google.com/recaptcha/api/siteverify", {
    secret: config.RecaptchaSecret,
    response: String(token)
});
if (!result || result.success !== true) throw new Error("Google validation failed!"); /* It didn't validate and code will exit here */

/* It validated, enter the code below to proceed with your desired actions */

IMPORTANT!

You need to use the legacy (secret) key when calling this Google API. See image below. Store it in a password field in #/Config.

Update 2026: for new sites we recommend Cloudflare Turnstile — see the KB article "Protect every form with Turnstile".