Memverifikasi respons pengguna
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memverifikasi respons pengguna terhadap tantangan reCAPTCHA dari backend
aplikasi Anda.
Untuk pengguna web, Anda bisa mendapatkan token respons pengguna dengan salah satu dari tiga cara berikut:
- Parameter POST
g-recaptcha-response saat pengguna mengirimkan formulir di situs Anda
grecaptcha.getResponse(opt_widget_id) setelah pengguna selesai
tantangan reCAPTCHA- Sebagai argumen string ke fungsi callback
jika
data-callback ditentukan dalam atribut tag g-recaptcha atau
parameter callback dalam metode grecaptcha.render
Untuk pengguna library Android, Anda dapat memanggil
SafetyNetApi.RecaptchaTokenResult.getTokenResult()
untuk mendapatkan token respons jika statusnya kembali berhasil.
Pembatasan Token
Setiap token respons pengguna reCAPTCHA valid selama dua menit, dan hanya dapat diverifikasi satu kali untuk
mencegah serangan berulang. Jika memerlukan token baru, Anda dapat menjalankan ulang verifikasi reCAPTCHA.
Setelah mendapatkan token respons, Anda perlu memverifikasinya dalam waktu dua menit dengan reCAPTCHA menggunakan
berikut untuk memastikan token valid.
Permintaan API
URL: https://www.google.com/recaptcha/api/siteverify
METODE: POST
| Parameter POST |
Deskripsi |
secret |
Wajib. Kunci yang dibagikan antara situs Anda dan reCAPTCHA. |
response |
Wajib. Token respons pengguna yang diberikan oleh integrasi sisi klien reCAPTCHA di situs Anda. |
remoteip |
Opsional. Alamat IP pengguna. |
Respons API
Responsnya adalah objek JSON:
{
"success": true|false,
"challenge_ts": timestamp, // timestamp of the challenge load (ISO format yyyy-MM-dd'T'HH:mm:ssZZ)
"hostname": string, // the hostname of the site where the reCAPTCHA was solved
"error-codes": [...] // optional
}
Untuk reCAPTCHA Android:
{
"success": true|false,
"challenge_ts": timestamp, // timestamp of the challenge load (ISO format yyyy-MM-dd'T'HH:mm:ssZZ)
"apk_package_name": string, // the package name of the app where the reCAPTCHA was solved
"error-codes": [...] // optional
}
Referensi kode error
| Kode error |
Deskripsi |
missing-input-secret |
Parameter secret tidak ada. |
invalid-input-secret |
Parameter rahasia tidak valid atau formatnya salah. |
missing-input-response |
Parameter respons tidak ada. |
invalid-input-response |
Parameter respons tidak valid atau formatnya salah. |
bad-request |
Permintaan tidak valid atau formatnya salah. |
timeout-or-duplicate |
Respons tidak lagi valid: terlalu lama atau telah digunakan sebelumnya. |
Kecuali dinyatakan lain, konten di halaman ini dilisensikan berdasarkan Lisensi Creative Commons Attribution 4.0, sedangkan contoh kode dilisensikan berdasarkan Lisensi Apache 2.0. Untuk mengetahui informasi selengkapnya, lihat Kebijakan Situs Google Developers. Java adalah merek dagang terdaftar dari Oracle dan/atau afiliasinya.
Terakhir diperbarui pada 2025-07-25 UTC.
[null,null,["Terakhir diperbarui pada 2025-07-25 UTC."],[[["\u003cp\u003eThis page details how to verify if a user successfully completed a reCAPTCHA challenge on your website or Android app.\u003c/p\u003e\n"],["\u003cp\u003eYou'll receive a response token from the reCAPTCHA integration that needs to be verified within two minutes using the reCAPTCHA API.\u003c/p\u003e\n"],["\u003cp\u003eVerification involves sending a POST request to the reCAPTCHA API with the secret key, response token, and optionally, the user's IP address.\u003c/p\u003e\n"],["\u003cp\u003eThe API response is a JSON object indicating success or failure, along with details like timestamp and potential error codes.\u003c/p\u003e\n"],["\u003cp\u003eEach response token is valid for a single use and expires after two minutes to prevent replay attacks.\u003c/p\u003e\n"]]],["To verify a user's reCAPTCHA response, obtain the response token via the `g-recaptcha-response` parameter, `grecaptcha.getResponse()`, or a callback function for web users or the `SafetyNetApi.RecaptchaTokenResult.getTokenResult()` method for Android. Then, within two minutes, send a POST request to `https://www.google.com/recaptcha/api/siteverify` with `secret` (your site's key) and `response` (the user token). The optional `remoteip` can be included. The JSON response indicates success, timestamp, and hostname or `apk_package_name` if Android, and error codes if any.\n"],null,["# Verifying the user's response\n\nThis page explains how to verify a user's response to a reCAPTCHA challenge from your application's\nbackend.\n\nFor web users, you can get the user's response token in one of three ways:\n\n- `g-recaptcha-response` POST parameter when the user submits the form on your site\n- [`grecaptcha.getResponse(opt_widget_id)`](/recaptcha/docs/display#js_api) after the user completes the reCAPTCHA challenge\n- As a string argument to your [callback function](/recaptcha/docs/display#render_param) if `data-callback` is specified in either the `g-recaptcha` tag attribute or the callback parameter in the `grecaptcha.render` method\n\nFor Android library users, you can call the\n[SafetyNetApi.RecaptchaTokenResult.getTokenResult()](https://developers.google.com/android/reference/com/google/android/gms/safetynet/SafetyNetApi.RecaptchaTokenResult.html#getTokenResult())\nmethod to get response token if the status returns successful.\n\nToken Restrictions\n------------------\n\nEach reCAPTCHA user response token is valid for two minutes, and can only be verified *once* to\nprevent replay attacks. If you need a new token, you can re-run the reCAPTCHA verification.\n\nAfter you get the response token, you need to verify it within two minutes with reCAPTCHA using the\nfollowing API to ensure the token is valid.\n\nAPI Request\n-----------\n\nURL: `https://www.google.com/recaptcha/api/siteverify`\n\nMETHOD: `POST`\n\n| POST Parameter | Description |\n|----------------|---------------------------------------------------------------------------------------------------|\n| `secret` | Required. The shared key between your site and reCAPTCHA. |\n| `response` | Required. The user response token provided by the reCAPTCHA client-side integration on your site. |\n| `remoteip` | Optional. The user's IP address. |\n\nAPI Response\n------------\n\nThe response is a JSON object: \n\n {\n \"success\": true|false,\n \"challenge_ts\": timestamp, // timestamp of the challenge load (ISO format yyyy-MM-dd'T'HH:mm:ssZZ)\n \"hostname\": string, // the hostname of the site where the reCAPTCHA was solved\n \"error-codes\": [...] // optional\n }\n\nFor reCAPTCHA Android: \n\n {\n \"success\": true|false,\n \"challenge_ts\": timestamp, // timestamp of the challenge load (ISO format yyyy-MM-dd'T'HH:mm:ssZZ)\n \"apk_package_name\": string, // the package name of the app where the reCAPTCHA was solved\n \"error-codes\": [...] // optional\n }\n\n### Error code reference\n\n| Error code | Description |\n|--------------------------|---------------------------------------------------------------------------------|\n| `missing-input-secret` | The secret parameter is missing. |\n| `invalid-input-secret` | The secret parameter is invalid or malformed. |\n| `missing-input-response` | The response parameter is missing. |\n| `invalid-input-response` | The response parameter is invalid or malformed. |\n| `bad-request` | The request is invalid or malformed. |\n| `timeout-or-duplicate` | The response is no longer valid: either is too old or has been used previously. |"]]
