Captcha providers

Configure captcha verification with reCAPTCHA, hCaptcha, or Cloudflare Turnstile.

Last updated Jul 16, 2026

rCTF can verify sensitive actions with reCAPTCHA, hCaptcha, or Cloudflare Turnstile.

Configuration

Choose a provider, then list the actions that should require it.

1
captcha:
2
  provider:
3
    name: captcha/turnstile
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key
7
  protectedEndpoints:
8
    - register
9
    - recover

Protected endpoints

The protectedEndpoints array controls which actions require captcha verification:

Action	Description
`register`	New account registration
`recover`	Account recovery via email
`setEmail`	Changing account email
`instancerStart`	Starting a challenge instance
`instancerExtend`	Extending a challenge instance lifetime
`avatarUpload`	Uploading a team avatar
`adminBotSubmit`	Submitting a job to the admin bot

Actions not listed in protectedEndpoints do not require captcha.

Note

Registration and recovery remain rate limited by client IP and destination email, even when captcha is enabled.

Providers

Google reCAPTCHA v2 Invisible. The frontend renders the widget with size: 'invisible' and verifies the response against https://www.google.com/recaptcha/api/siteverify.

1
captcha:
2
  provider:
3
    name: captcha/recaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_RECAPTCHA_SITE_KEY`	reCAPTCHA site key
`secretKey`	`RCTF_RECAPTCHA_SECRET_KEY`	reCAPTCHA secret key

hCaptcha verification.

1
captcha:
2
  provider:
3
    name: captcha/hcaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_HCAPTCHA_SITE_KEY`	hCaptcha site key
`secretKey`	`RCTF_HCAPTCHA_SECRET_KEY`	hCaptcha secret key

Cloudflare Turnstile verification.

1
captcha:
2
  provider:
3
    name: captcha/turnstile
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_TURNSTILE_SITE_KEY`	Turnstile site key
`secretKey`	`RCTF_TURNSTILE_SECRET_KEY`	Turnstile secret key

Migrating from v1

rCTF converts the v1 recaptcha block at startup, but new configuration should use the provider format:

1
recaptcha:
2
  siteKey: your-site-key
3
  secretKey: your-secret-key
4
  protectedActions:
5
    - register

1
captcha:
2
  provider:
3
    name: captcha/recaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key
7
  protectedEndpoints:
8
    - register