Google Recaptcha missing-input-secret

Was trying to make Google Recaptcha work but kept getting failed attempts and the error missing-input-secret back.

After checking that my secret key was correct, I realized the verification endpoint does not expect a JSON body. It expects URL-encoded form fields.

I was sending the values in the body:

const response = await fetch('https://www.google.com/recaptcha/api/siteverify', {
  method: "POST",
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    secret: CAPTCHA_SITE_SECRET,
    response: CAPTCHA_VALUE_FROM_CLIENT
  })
})

Send the request from your server, with the values in a URLSearchParams body:

const response = await fetch(
  'https://www.google.com/recaptcha/api/siteverify',
  {
    method: 'POST',
    body: new URLSearchParams({
    secret: CAPTCHA_SITE_SECRET,
    response: CAPTCHA_VALUE_FROM_CLIENT
    })
  }
)

const result = await response.json()

if (!result.success) {
  console.error(result['error-codes'])
}

Never send CAPTCHA_SITE_SECRET to the browser. A reCAPTCHA response token is single-use and expires after two minutes, so verify it promptly. Depending on the reCAPTCHA version, also check fields such as the hostname, action, and score instead of trusting success alone.