Captcha providers

Configure captcha verification with reCAPTCHA, hCaptcha, or Cloudflare Turnstile.

Last updated Sep 7, 2026

rCTF can verify sensitive actions with reCAPTCHA, hCaptcha, or Cloudflare Turnstile.

Configuration

Choose a provider, then list the actions that should require it.

1
captcha:
2
  provider:
3
    name: captcha/turnstile
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key
7
  protectedEndpoints:
8
    - register
9
    - recover
10
    - setEmail
11
    - instancerStart
12
    - instancerExtend
13
    - avatarUpload
14
    - adminBotSubmit

The supported actions are:

Action	Description
`register`	New account registration
`recover`	Account recovery via email
`setEmail`	Changing account email
`instancerStart`	Starting a challenge instance
`instancerExtend`	Extending a challenge instance lifetime
`avatarUpload`	Uploading a team avatar
`adminBotSubmit`	Submitting a job to the admin bot

When protectedEndpoints is set, actions not listed do not require captcha. When it is omitted, all supported actions are protected.

Note

Registration and recovery remain rate limited by client IP and destination email, even when captcha is enabled.

Providers

Google reCAPTCHA v2 Invisible. The frontend renders the widget with size: 'invisible' and verifies the response against https://www.google.com/recaptcha/api/siteverify.

1
captcha:
2
  provider:
3
    name: captcha/recaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_RECAPTCHA_SITE_KEY`	reCAPTCHA site key
`secretKey`	`RCTF_RECAPTCHA_SECRET_KEY`	reCAPTCHA secret key

hCaptcha verification.

1
captcha:
2
  provider:
3
    name: captcha/hcaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_HCAPTCHA_SITE_KEY`	hCaptcha site key
`secretKey`	`RCTF_HCAPTCHA_SECRET_KEY`	hCaptcha secret key

Cloudflare Turnstile verification.

1
captcha:
2
  provider:
3
    name: captcha/turnstile
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_TURNSTILE_SITE_KEY`	Turnstile site key
`secretKey`	`RCTF_TURNSTILE_SECRET_KEY`	Turnstile secret key

Migrating from v1

rCTF converts the v1 recaptcha block at startup, but new configuration should use the provider format:

1
recaptcha:
2
  siteKey: your-site-key
3
  secretKey: your-secret-key
4
  protectedActions:
5
    - register

1
captcha:
2
  provider:
3
    name: captcha/recaptcha
4
    options:
5
      siteKey: your-site-key
6
      secretKey: your-secret-key
7
  protectedEndpoints:
8
    - register