CAPTCHA

Node catalog Actions

On this page

Validate a CAPTCHA on the server: Cloudflare Turnstile, Google reCAPTCHA v2/v3 or hCaptcha.

Usage and specifics

The token comes from the client form; validation uses the server-side secret. Check hostname, action and score for reCAPTCHA v3. The secret can come from a variables credential.

Technical type : captcha. Runtime : nodulz.

Credentials and prerequisites

Create and configure the credential : captcha

Create credentials in your nodulz instance’s Credentials area, then select them on the node. Availability depends on ownership and sharing. See the credentials guide for access and rotation.

Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

Parameter	Type	Default	Values / limits
`provider`	`enum`	`"turnstile"`	`turnstile`, `recaptcha_v2`, `recaptcha_v3`, `hcaptcha`
`credentialId`	`string`	`""`	-
`secretName`	`string`	`"CAPTCHA_SECRET"`	-
`token`	`string`	`"{{ input.body[\"cf-turnstile-response\"] }}"`	-
`remoteIp`	`string`	`""`	-
`siteKey`	`string`	`""`	-
`expectedHostname`	`string`	`""`	-
`expectedAction`	`string`	`""`	-
`minScore`	`number`	`0.5`	-; ≥ 0, ≤ 1
`failOnInvalid`	`boolean`	`true`	-
`timeoutMs`	`number`	`10000`	-; ≥ 100, ≤ 30000

Configuration help

credentialId Secrets credential: Create a Secret variables credential containing the provider secret key. It stays encrypted in Nodulz.
secretName Secret variable name: Name of the variable holding the secret key in this credential, for example CAPTCHA_SECRET. Do not enter the key here.
token CAPTCHA token: Token submitted by the form. Use an expression or drag the field from the webhook data.
expectedHostname Expected hostname: Recommended: exact form hostname, without protocol or path. A different or missing hostname is rejected.
expectedAction Expected action: Action configured in the widget, matched exactly. Required for reCAPTCHA v3; optional for Turnstile.
minScore Minimum score: reCAPTCHA v3: accepts scores at or above this threshold (0 to 1). A missing score is rejected.
siteKey Public site key: hCaptcha: recommended public key to bind verification to the expected widget.
remoteIp Visitor IP address: Optional. Only use an address determined by a trusted source, not a freely submitted form value.
failOnInvalid Stop if CAPTCHA is rejected: Enabled by default. Disable to get success=false, then use an If node before protected actions and a 403 webhook response. Network errors always stop the node.

Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

json

{
  "provider": "turnstile",
  "credentialId": "",
  "secretName": "CAPTCHA_SECRET",
  "token": "{{ input.body[\"cf-turnstile-response\"] }}",
  "expectedHostname": "",
  "expectedAction": "",
  "minScore": 0.5,
  "failOnInvalid": true
}

Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.