> For the complete documentation index, see [llms.txt](https://docs.samita.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.samita.io/sa-request-a-quote/quote-form/recaptcha.md).

# Add reCAPTCHA

Connect Google reCAPTCHA v2 to your quote form to stop automated spam submissions.

A public form with an email field attracts bots. Google reCAPTCHA adds a check that stops most automated submissions without getting in a real customer's way. The app describes it as "reCAPTCHA offers more than just spam protection".

Setting it up is two jobs: register your store with Google, then add the keys Google gives you to the app. You'll need a Google account.

{% hint style="warning" %}
**Register for reCAPTCHA v2, the "I'm not a robot" Checkbox.** That is the version this integration is built for. v3 works invisibly and issues a different kind of key, so a v3 key pair pasted into the app gives you a form with no visible check and no protection. Google decides the version when you register, so get it right on the registration form rather than discovering it afterwards.
{% endhint %}

## Step 1 — Get your keys from Google

{% stepper %}
{% step %}

### Open the reCAPTCHA admin console

Go to [Google reCAPTCHA](https://www.google.com/recaptcha/admin/create) and sign in with your Google account.

You can also get there from inside the app: the **Google reCAPTCHA** page carries the line "Click **here** to create your own reCAPTCHA site key and secret key for your website", and **here** is a link to the same console.
{% endstep %}

{% step %}

### Fill in the registration form

Google asks for five things. The second one is the one that decides whether this works at all:

<table><thead><tr><th width="190">Field</th><th>What to enter</th></tr></thead><tbody><tr><td><strong>Label</strong></td><td>A name that tells you which site this key belongs to when you come back to it in a year. Your store name is the obvious choice.</td></tr><tr><td><strong>reCAPTCHA type</strong></td><td><strong>reCAPTCHA v2</strong>, then the <strong>"I'm not a robot" Checkbox</strong> option beneath it. Not v3, and not the invisible badge or the Android options.</td></tr><tr><td><strong>Domain</strong></td><td>Your Shopify store domain — the address the quote form is served at.</td></tr><tr><td><strong>Owners</strong></td><td>Leave it. Google sets it to the account you signed in with. Add more addresses only if a colleague should also administer the key.</td></tr><tr><td><strong>Alerts</strong></td><td>Worth switching on. It emails the owners when Google spots a problem on your site — a misconfigured reCAPTCHA, or a rise in suspicious traffic. The first of those is precisely the failure this page is about, so let Google tell you rather than waiting for a customer to.</td></tr></tbody></table>

Fill all of it in correctly, then submit the form.
{% endstep %}

{% step %}

### Copy the two keys

Google then shows you a pair of keys: a **site key** and a **secret key**. Keep the page open; you'll paste both into the app in a moment, into fields with those same two names.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The domain you register has to be the domain customers actually browse when they reach the quote form. A mismatch between the two is the single most common reason the check never appears.
{% endhint %}

## Step 2 — Add the keys to the app

{% stepper %}
{% step %}

### Open the integration settings

In the app, go to **Advanced settings** and open the **Integrations** tab. Under **Third-party integration**, find **Google reCAPTCHA** and open it — each integration has its own page.
{% endstep %}

{% step %}

### Paste your keys

The page has exactly two fields, one under the other:

<table><thead><tr><th width="190">Field in the app</th><th>What goes in it</th></tr></thead><tbody><tr><td><strong>Site key</strong></td><td>The <strong>site key</strong> Google issued — the public half of the pair.</td></tr><tr><td><strong>Secret key</strong></td><td>The <strong>secret key</strong> Google issued — the private half. Don't paste it anywhere else or share it outside your team.</td></tr></tbody></table>

Google names its two keys the same way the app does, so this is a straight copy across. They are not interchangeable, so take care not to swap them over — that is the mistake people make most often. Copy one, paste it, then go back for the other, rather than copying both and trusting your memory.

<figure><img src="https://2993310686-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIvNtDAMNVIdy5nl9kiOU%2Fuploads%2FZQQ1uO1PnMO2z4a7rNlt%2Fimage.png?alt=media&amp;token=1b349bed-fb49-417e-987b-41043bbbb93e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2993310686-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIvNtDAMNVIdy5nl9kiOU%2Fuploads%2F4epvZlapf8IPUhcNfw3x%2Fimage.png?alt=media&amp;token=8b8640cc-4b73-4696-ba67-406537749887" alt=""><figcaption><p>Paste both keys from Google, then save.</p></figcaption></figure>
{% endstep %}

{% step %}

### Save and check the result on your storefront

Save your changes, then open the quote form on your storefront as a customer would. The **"I'm not a robot"** checkbox should be sitting on the form.

Send a real test request through it. Seeing the checkbox only proves the site key works; completing a submission is what proves the secret key does too.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
Saved keys come back masked when you reopen the page — the app stores integration keys as a masked placeholder rather than showing them again. That's expected. Paste a fresh key only when you actually want to change one.
{% endhint %}

{% hint style="warning" %}
Test with a real submission every time you change these keys. A misconfigured check can silently block genuine customers, and you won't see the requests that never arrived.
{% endhint %}

## If the check doesn't appear

* **Check you registered v2, not v3.** A v3 key pair produces no visible checkbox — that is what v3 is for. Open your site in the Google reCAPTCHA console and look at the type it was registered as. If it says v3, register a new v2 "I'm not a robot" Checkbox site and replace both keys.
* **Check the domain matches.** The domain registered with Google must match the domain customers actually use.
* **Check both keys were saved, and the right way round.** The app's **Site key** field takes Google's site key and the **Secret key** field takes Google's secret key. Paste them again from Google if you're unsure, then save.
* **Check the app is switched on in your theme.** On the app dashboard, the **Setup guide** shows **App embed is enabled** or **App embed is disabled**, with an **Enable app embed** button.
* **Check the fields aren't locked.** If they are greyed out with a padlock line reading "🔐 This feature is available on …", the integration belongs to a higher plan. That is your plan, not a fault — open **Pricing plans** in the app.

## Next steps

* [Build a standard form](/sa-request-a-quote/quote-form/build-standard-form.md) — the rest of your form
* [Integrations overview](/sa-request-a-quote/integrations/overview.md) — connect quote data to your other tools
* [Allow file uploads](/sa-request-a-quote/quote-form/file-uploads.md) — which file types the app accepts, and the storage uploads use


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.samita.io/sa-request-a-quote/quote-form/recaptcha.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.