reCAPTCHA v3 tokens
that pass in production.
An asynchronous createTask / getTaskResult API: send the page and the sitekey, get back a ready-to-use token. Validated pages, published success rate, billed on results only.
curl -sS {{apiPublic}}/createTask \ -H 'content-type: application/json' \ --data '{ "clientKey": "YOUR_PRIVATE_KEY", "task": { "type": "RecaptchaV3TaskProxyless", "websiteURL": "https://www.acehardware.com/user/login", "websiteKey": "6LeOCzAtAAAAAEMV83_o-Sx6uZsxO_haVNGyojSB", "minScore": 0.9, "pageAction": "LOGIN", "isEnterprise": true } }'
{ "errorId": 0, "status": "ready", "solution": { "gRecaptchaResponse": "03AFcWeA…" }, "createTime": 1757664000, "endTime": 1757664012 }
One thing, done well.
Capciao does reCAPTCHA v3 / Enterprise only, on validated pages, with a success rate that is measured and published. You know what you are buying, and you only pay for what works.
Page validated before the first task
Every page (URL, sitekey, action) is validated under real conditions, then added to the registry. A task outside the registry is rejected immediately, without using a slot or being billed.
Tokens that pass
Every token is issued by Google and tested until it succeeds on the target page before a page enters the registry. The success rate is measured continuously and shown on the status page.
reCAPTCHA updates tracked
When Google ships a new reCAPTCHA version, we validate it before returning a single token. You get an explicit error code instead of a token that is silently rejected.
Standard contract
createTask / getTaskResult routes, fields and error codes in the asynchronous format your integrations already know: plugging in Capciao comes down to changing the base URL.
Nothing is retained
Parameters, keys and tokens are never written to disk or logged. The token lives 90 seconds in memory, then disappears. Only task metadata is kept.
Honest monitoring
Two public health routes, a distinct error code for every rejection cause, a status page. You always know whether the problem is on our side, Google's, or in your request.
Three calls. One token.
The contract is asynchronous: you create the task, Capciao produces the token, you fetch it and use it right away.
Create the task
Send the page URL, its sitekey, the action and the Enterprise mode. The request is checked against the validated page registry and receives an ID.
POST /createTask → taskIdCapciao does the work
Capciao runs reCAPTCHA on the target page and obtains a token issued by Google. Expect 5 to 20 seconds.
status: "processing"Fetch and use
Read the result with long polling, or use /solve to do everything in one call. As soon as it is ready, inject the token into your business request without waiting: it expires in two minutes.
status: "ready" → tokenIntegrate in five minutes, in your language
The examples on the right are complete: creation, polling, error handling, timeout. Copy, replace the key, run.
- A single task type:
RecaptchaV3TaskProxyless - Business responses always HTTP 200, the error is in
errorCode - Long polling or synchronous
/solve: the token arrives as soon as it exists - Maximum task duration: 90 seconds
Compare our plans.
The same API contract on every plan. Choose the volume, the level of support and the guarantees you need; switch plans at any time from your account.
| What is included | Starter | Pro | Enterprise |
|---|---|---|---|
| Price per 1,000 tokens | $2.99 | $2.49 | Custom pricing, volume discounts |
| Monthly volume | up to 100,000 tokens | up to 300,000 tokens | custom, no cap |
| Pages in the validated registry | ✓ | ✓ | ✓ |
| Validation of a new target page | custom pricing | 1 page included | unlimited |
| Concurrent tasks per key | 2 | 4 | 8 and more, reserved slots |
| Execution priority | standard | priority during reCAPTCHA updates | reserved slots |
| reCAPTCHA update notifications | status page | email before and after | email + dedicated channel |
| Support | email, 1 business day | dedicated channel, 4 business hours | contractual commitment |
| API keys | 1 key, self-service rotation | 1 key, self-service rotation | multiple keys |
| Monthly report (volumes, durations, error codes) | Console | Console | Console + report delivered |
| Uptime | status page | status page | contractual commitment (SLA) |
| Payment | card, pay as you go, cancel anytime | monthly invoice | |
All plans share the same technical scope and the same results-based billing: only tasks completed with a token are counted. Pricing details →
What is supported, precisely.
No marketing list: here is what the API accepts today and what it rejects, with the matching error code.
reCAPTCHA v3 Available
Invisible tokens with action, requested score 0.3, 0.7 or 0.9. Domain google.com.
reCAPTCHA Enterprise Available
isEnterprise: true mode, including invisible integrations behind a WAF.
Validation of a new page On request
Send the URL and the sitekey. We validate the page under real conditions, then add it to the registry. Usual turnaround: a few business days.
Out of scope
reCAPTCHA v2 (images), hCaptcha, Turnstile, FunCaptcha, client proxies, HTTP callbacks. A task of any other type receives ERROR_TASK_NOT_SUPPORTED.
One price per thousand tokens. Nothing else.
You only pay for tasks completed with a token. Scope rejections, full queues and outages on our side are never billed.
Starter
To get started on already validated pages.
- All pages in the validated registry
- 2 concurrent tasks
- Console and local history
- Email support
Pro
For steady volume and your own target page.
- Everything in Starter, 4 concurrent tasks
- One target page validation included
- Priority on every reCAPTCHA update
- Dedicated support channel
Enterprise
For multiple pages, reserved slots and a service commitment.
- Everything in Pro
- Unlimited validated pages
- Reserved execution slots
- Uptime commitment and monthly report
Prices in USD, excl. tax. Pricing details and calculator →
Frequently asked questions
Do you guarantee the reCAPTCHA score?
No, and nobody honestly can. minScore is a client request accepted for contract compatibility. A ready task proves that Google issued a token; success on the target site remains the final oracle. Our per-page validation targets exactly that success.
Why is my page not accepted?
The API only serves pages in the validated registry. If you receive ERROR_PROFILE_NOT_VALIDATED, check the exact URL, the sitekey, the action and the Enterprise mode, or request validation of your page. The rejection uses no slot and is not billed.
Can I reuse a token?
No. A reCAPTCHA v3 token cannot be replayed and expires about two minutes after it is issued. Every business submission requires a new task. Fetch the result and use it immediately.
What happens when Google ships a new release?
Tasks receive ERROR_RELEASE_NOT_VALIDATED until the new release is validated. We would rather reject than issue a token that will be refused. The status page shows the release currently being validated.
Do I need to provide a proxy?
No. The only task type is RecaptchaV3TaskProxyless: nothing to configure on your side. A proxy field would be rejected as an unknown field.
Where are my tokens and my key stored?
Nowhere. The key is checked in memory, task parameters are not logged, the token stays 90 seconds in memory and then disappears. Only metadata (ID, status, timestamps, error code) is kept in the database.
What is the capacity?
Each key can run several tasks in parallel depending on its plan (2 on Starter, 4 on Pro, more on Enterprise with reserved slots). Beyond that, ERROR_NO_SLOT_AVAILABLE tells you to retry as soon as a task completes — expect 5 to 20 seconds per task.
My integration already uses createTask / getTaskResult, what do I need to change?
The base URL. The createTask and getTaskResult routes, fields and error codes are identical within the supported scope. Remove the fields we do not accept (callback, proxy, softId): they would be rejected. Migration guide →
Your first task in under five minutes.
Request a key, paste the example in your language, run it. If your page is not validated yet, tell us in the same message.