VERISCO Shield Authenticate
Captcha
Five providers. Two are hosted by VERISCO and need nothing from you; three are hosted by their vendor and use your own keys.
Choose a provider on Auth Factors or Captcha in your console. The captcha is shown on your sign-in page and checked on the server before the password is.
Providers#
| Provider | Keys | Notes |
|---|---|---|
| hCaptcha | Your own site key and secret. | A hosted challenge. Create the keys at hcaptcha.com. |
| reCAPTCHA | Your own site key and secret. | Google reCAPTCHA, version 2 or version 3. See below. |
| Cloudflare Turnstile | Your own site key and secret. | Cloudflare Turnstile. Usually solved without interaction. |
| mCaptcha | None. Managed by VERISCO. | A proof-of-work widget. The browser does a short computation; there is nothing to click through. |
| ALTCHA | None. Managed by VERISCO. | A proof-of-work challenge. The user ticks one box and the browser solves it. |
Which to choose#
| If | Choose |
|---|---|
| You want nothing to set up, and no third party on your sign-in page | ALTCHA or mCaptcha |
| You already use Cloudflare | Turnstile |
| You already hold Google or hCaptcha keys | reCAPTCHA or hCaptcha |
reCAPTCHA: version 2 or version 3#
reCAPTCHA is the one provider with two kinds of key, and you choose between them on the Captcha page.
| Version 2 · Checkbox | Version 3 · Score | |
|---|---|---|
| What the user does | Ticks "I'm not a robot", and sometimes solves an image challenge. | Nothing. There is no widget, only Google's badge. |
| How it decides | Google returns pass or fail. | Google returns a score from 0 to 1. A score under 0.5 is refused. |
| If Google doubts a real person | They get a challenge to solve. | They are refused, with no challenge to fall back on. |
| Key type to create | reCAPTCHA v2, "I'm not a robot" Checkbox | reCAPTCHA v3 |
The keys are not interchangeable
Google issues version 2 and version 3 keys separately, and one does not work as the other. A version 3 key used with the checkbox shows "ERROR for site owner: Invalid key type" to every visitor, and nobody can sign in. The key you enter must be of the version you selected. An invisible version 2 key does not work with either.
Version 3 is the more comfortable for your users and the less forgiving. Try it from the networks your users are on before relying on it.
Your own keys#
For hCaptcha, reCAPTCHA and Turnstile you enter a site key (public) and a secret key (private). Register the keys for the address of your VERISCO sign-in page, not for your application's own hostname: that is where the widget is displayed.
If you leave the fields empty, the platform's own key for that provider is used, when it has one.
What is refused#
Your console will not let you save a provider that cannot work:
- a hosted provider with no production key. It would fall back to the vendor's public test key, which lets every visitor through;
- mCaptcha, when its server is not ready.
The reason is shown when the save is refused.
Troubleshooting#
| Symptom | Cause |
|---|---|
| "Invalid key type" on the widget | A reCAPTCHA key of the wrong version. |
| "Invalid domain for site key" | The key is not registered for the sign-in page's address. |
| "Please complete the captcha check" after solving it | The secret key does not belong to the site key. |
| Real users refused on reCAPTCHA v3 | Google scored them under 0.5. Switch to version 2 or another provider. |
Something missing or wrong on this page? Tell us and we will fix it.