How to setup Google reCAPTCHA
Follow this guide to create a Google reCAPTCHA token (human validation) in Docly™.
PART 1 - Create a Google site key
Open Google Cloud Console
Create a project and open
Activate reCAPTCHA Enterprise
This is done / enabled under APIs and services.
Navigate to: Security > Recaptcha enterprise
Configure a site key in Google Cloud Console
Use checkbox challenge, and add at least one domain to your list
You should also store the LEGACY key if you want to call the API to verify the tokens. Keep it in a configuration document under #/, never in code or in a screenshot.
PART 2 - Use "Google reCAPTCHA v2.0" in your API
Add reCAPTCHA HTML markup and javascript
Add reCAPTCHA field inside your form:
<form id="SignUp" data-message="Thank you, your form has been submitted.">
<div class="form-group">
<label>Email</label>
<input class="form-control input-lg" name="Email" type="email" required>
</div>
<div class="form-group">
<div class="g-recaptcha" id="captcha1" data-sitekey="ENTER-YOUR-SITE-KEY-HERE"></div>
</div>
<button class="btn btn-success btn-lg" type="submit">Sign up</button>
</form>Remember to insert your site key where it says: "ENTER-YOUR-SITE-KEY-HERE"
Add script at the end of the page:
<script src="https://www.google.com/recaptcha/api.js" async defer></script>This example form looks like this:
Either pass the Google reCAPTCHA value or submit the form to your apropriate API end point (default input field name is "g-recaptcha-response")
Validate reCAPTCHA in API
In order to check that the reCAPTCHA was valid you must submit the result value and code a check of this value from an API function. Your API function will call the Google API to check the reCAPTCHA result.
#/API/Example.js
/* This code checks that the reCAPTCHA token posted with the form is valid */
/* The secret key (Google calls it the legacy key) lives in #/Config, never in code */
var config = docly.getJson("#/Config") || {};
var token = form["g-recaptcha-response"];
if (token && typeof token !== "string") token = token.length > 0 ? token[0] : "";
if (!token) throw new Error("Validation failed: token not specified!");
/* httpFormPost sends the secret in the form body, not in the URL */
var result = docly.httpFormPost("https://www.google.com/recaptcha/api/siteverify", {
secret: config.RecaptchaSecret,
response: String(token)
});
if (!result || result.success !== true) throw new Error("Google validation failed!"); /* It didn't validate and code will exit here */
/* It validated, enter the code below to proceed with your desired actions */IMPORTANT!
You need to use the legacy (secret) key when calling this Google API. See image below. Store it in a password field in #/Config.
Update 2026: for new sites we recommend Cloudflare Turnstile — see the KB article "Protect every form with Turnstile".




