# CAPTCHA - Workflow node | Docs - nodulz

Source: https://nodulz.com/docs/nodes/captcha

Language: en

Validate a CAPTCHA on the server: Cloudflare Turnstile, Google reCAPTCHA v2/v3 or hCaptcha.

## Usage and specifics

The token comes from the client form; validation uses the server-side secret. Check hostname, action and score for reCAPTCHA v3. The secret can come from a variables credential.

Technical type : `captcha`. Runtime : `nodulz`.

## Credentials and prerequisites

- [Create and configure the credential : captcha](/docs/credentials/captcha)

Create credentials in your nodulz instance’s Credentials area, then select them on the node. Availability depends on ownership and sharing. See the [credentials guide](/docs/credentials) for access and rotation.

## Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

| Parameter | Type | Default | Values / limits |
| --- | --- | --- | --- |
| `provider` | `enum` | `"turnstile"` | `turnstile`, `recaptcha_v2`, `recaptcha_v3`, `hcaptcha` |
| `credentialId` | `string` | `""` | - |
| `secretName` | `string` | `"CAPTCHA_SECRET"` | - |
| `token` | `string` | `"{{ input.body[\"cf-turnstile-response\"] }}"` | - |
| `remoteIp` | `string` | `""` | - |
| `siteKey` | `string` | `""` | - |
| `expectedHostname` | `string` | `""` | - |
| `expectedAction` | `string` | `""` | - |
| `minScore` | `number` | `0.5` | -; ≥ 0, ≤ 1 |
| `failOnInvalid` | `boolean` | `true` | - |
| `timeoutMs` | `number` | `10000` | -; ≥ 100, ≤ 30000 |

## Configuration help

| Setting | Purpose and guidance |
| --- | --- |
| `credentialId`<br>Secrets credential | Create a Secret variables credential containing the provider secret key. It stays encrypted in Nodulz. |
| `secretName`<br>Secret variable name | Name of the variable holding the secret key in this credential, for example CAPTCHA_SECRET. Do not enter the key here. |
| `token`<br>CAPTCHA token | Token submitted by the form. Use an expression or drag the field from the webhook data. |
| `expectedHostname`<br>Expected hostname | Recommended: exact form hostname, without protocol or path. A different or missing hostname is rejected. |
| `expectedAction`<br>Expected action | Action configured in the widget, matched exactly. Required for reCAPTCHA v3; optional for Turnstile. |
| `minScore`<br>Minimum score | reCAPTCHA v3: accepts scores at or above this threshold (0 to 1). A missing score is rejected. |
| `siteKey`<br>Public site key | hCaptcha: recommended public key to bind verification to the expected widget. |
| `remoteIp`<br>Visitor IP address | Optional. Only use an address determined by a trusted source, not a freely submitted form value. |
| `failOnInvalid`<br>Stop if CAPTCHA is rejected | Enabled by default. Disable to get success=false, then use an If node before protected actions and a 403 webhook response. Network errors always stop the node. |

## Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

```json
{
  "provider": "turnstile",
  "credentialId": "",
  "secretName": "CAPTCHA_SECRET",
  "token": "{{ input.body[\"cf-turnstile-response\"] }}",
  "expectedHostname": "",
  "expectedAction": "",
  "minScore": 0.5,
  "failOnInvalid": true
}
```

## Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.

See also : [Expressions and data](/docs/expressions), [Executions](/docs/executions), [Node catalog](/docs/nodes).

## Explore further

- [Features - nodulz](https://nodulz.com/product/overview)
- [Node catalog - nodulz](https://nodulz.com/product/catalog)
- [MCP server - nodulz](https://nodulz.com/product/mcp)
- [Pricing - nodulz](https://nodulz.com/pricing)
- [Use cases and workflow automation - nodulz](https://nodulz.com/use-cases)
- [Choose what your workflows can do. - nodulz](https://nodulz.com/compare)
- [Documentation - nodulz](https://nodulz.com/docs)