API referenceTask typesreCAPTCHA v3

reCAPTCHA v3

No challenge and nothing to click. v3 scores the visit in the background and the site decides what to do with the number. The action name matters more here than anywhere else.

Task types

Type string	Proxy	Use it for
`ReCaptchaV3TaskProxyLess`	None	The ordinary case.
`ReCaptchaV3Task`	Yours	Sites that score the asking address as well as the token.

Task object

Field	Type	Required	What it is
`type`	String	Yes	One of the two above.
`websiteURL`	String	Yes	The page carrying the captcha.
`websiteKey`	String	Yes	The site key.
`pageAction`	String	No	The action the page names. Get this right; see below.
`proxy`	String	On `ReCaptchaV3Task`	The type without the ProxyLess suffix requires one, in either shape.
`isSession`	Bool	No	Returns the `recaptcha-ca-t` cookie value.
`apiDomain`	String	No	Only set it if the page loads from `recaptcha.net`.

The action name

v3 ties the score to an action string. Submit a token minted for homepage against a form expecting checkout and the site will refuse it, even though the token itself is valid.

Search the page for grecaptcha.execute.
The second argument holds the action, usually as { action: "login" }.
Copy that string into pageAction exactly, including case.

Example

POST/createTask

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "ReCaptchaV3TaskProxyLess",
    "websiteURL": "https://example.com/checkout",
    "websiteKey": "6LcR_okUAAAAAPYr...",
    "pageAction": "checkout"
  }
}

JSON

{
  "errorId": 0,
  "taskId": "8d0d2b1c-5b9f-4c2a-9c1a-0242ac110006",
  "status": "ready",
  "solution": {
    "gRecaptchaResponse": "3AHJ...",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...",
    "expireTime": 1671615324290
  }
}

Put gRecaptchaResponse wherever the page would have put it, which for v3 is usually a hidden field or a JSON body rather than a form control.

About the score

v3 returns a number between 0.0 and 1.0 to the site, not to you. We do not see it and cannot promise one. What we can do is mint a token that looks like an ordinary visit, which is what the score is reading.

If a site rejects tokens that a browser session passes, the difference is usually the address or the user agent, not the token. Send the userAgent we return, and put an address of yours behind it with ReCaptchaV3Task.

Last updated 21 September 2026