How to bypass Google reCAPTCHA with solver
Google reCAPTCHA protects websites from automated abuse by evaluating the visitor, browser session, and requested action.
Depending on the version, reCAPTCHA may display a checkbox, show an image challenge, run invisibly after a button click, or assign a risk score without showing any visible interface.
With the SolveCaptcha API, you can submit the public reCAPTCHA parameters, receive a response token, and use that token in the protected form or request.
The general workflow is:
Identify the reCAPTCHA version
→ extract the site key and required parameters
→ create a SolveCaptcha task
→ wait for the result
→ retrieve the response token
→ submit the token through the expected field or callback
This guide covers:
- reCAPTCHA v2 checkbox;
- Invisible reCAPTCHA v2;
- reCAPTCHA v3;
- reCAPTCHA Enterprise;
- site key detection;
- task creation;
- result polling;
- token insertion;
- callback handling;
- common errors.
Use these methods only on websites you own or are authorized to test and automate.
What is Google reCAPTCHA?
Google reCAPTCHA is a security service designed to distinguish legitimate visitors from automated traffic.
It can help websites reduce:
- spam submissions;
- fake registrations;
- automated login attempts;
- credential stuffing;
- abusive form activity;
- high-volume automated requests.
reCAPTCHA does not rely on one signal.
Depending on the version and integration, Google may evaluate:
- browser properties;
- cookies;
- user interaction;
- IP reputation;
- request history;
- page context;
- action name;
- previous activity;
- session consistency.
The website receives a response token and verifies it on the server.
The token is not a permanent access credential. It is normally associated with a specific site key, page, action, and short-lived verification flow.
Types of Google reCAPTCHA
Google provides several reCAPTCHA versions.
reCAPTCHA v2 checkbox
The standard reCAPTCHA v2 widget displays the familiar checkbox:
I'm not a robot
A simple interaction may complete the verification immediately.
When Google requires additional confirmation, it can display an image challenge asking the visitor to select objects such as:
- traffic lights;
- cars;
- buses;
- bicycles;
- crosswalks.
A common implementation looks like this:
<div
class="g-recaptcha"
data-sitekey="SITE_KEY">
</div>
The public site key is stored in:
data-sitekey
Invisible reCAPTCHA v2
Invisible reCAPTCHA v2 does not initially display a checkbox.
It is usually triggered when the visitor:
- clicks a button;
- submits a form;
- requests a verification code;
- starts checkout;
- performs another protected action.
A typical implementation looks like this:
<button
class="g-recaptcha"
data-sitekey="SITE_KEY"
data-size="invisible"
data-callback="onCaptchaSolved">
Continue
</button>
Invisible reCAPTCHA still returns a reCAPTCHA v2 token.
For SolveCaptcha, it uses the standard reCAPTCHA method with:
invisible=1
reCAPTCHA v3
reCAPTCHA v3 works without a checkbox or image challenge.
It generates a token for a specific action and returns a score during server-side verification.
Common actions include:
login
register
checkout
search
contact
submit
password_reset
A typical implementation looks like this:
grecaptcha.execute(
"SITE_KEY",
{
action: "login"
}
);
The website verifies the token and receives values such as:
{
"success": true,
"score": 0.7,
"action": "login",
"hostname": "example.com"
}
The website decides which score is acceptable.
reCAPTCHA Enterprise
reCAPTCHA Enterprise is designed for applications that require additional control, reporting, and enterprise security features.
Depending on the configuration, it can behave like:
- reCAPTCHA v2;
- Invisible reCAPTCHA v2;
- reCAPTCHA v3.
For SolveCaptcha, Enterprise tasks use the standard reCAPTCHA method with:
enterprise=1
Additional parameters such as action, min_score, data-s, cookies, or User-Agent may also be required.
SolveCaptcha API endpoints
SolveCaptcha uses two main endpoints.
Create a task:
POST https://api.solvecaptcha.com/in.php
Retrieve the result:
GET https://api.solvecaptcha.com/res.php
For all Google reCAPTCHA variants covered in this guide, the base method is:
method=userrecaptcha
The version-specific parameters determine how the task is processed.
Main parameter differences
| reCAPTCHA type | Required parameters |
|---|---|
| reCAPTCHA v2 | method=userrecaptcha, googlekey, pageurl |
| Invisible v2 | v2 parameters plus invisible=1 |
| reCAPTCHA v3 | v2 parameters plus version=v3, action, min_score |
| Enterprise v2 | v2 parameters plus enterprise=1 |
| Enterprise v3 | enterprise=1, version=v3, action, min_score |
Do not use unsupported API structures such as:
createTask
getTaskResult
clientKey
websiteKey
websiteURL
RecaptchaV2TaskProxyless
RecaptchaV3TaskProxyless
The documented SolveCaptcha parameters are:
key
method
googlekey
pageurl
invisible
version
action
min_score
enterprise
How to find the reCAPTCHA site key
The site key is a public identifier used by the website’s reCAPTCHA integration.
It can appear in several places.
data-sitekey attribute
Example:
<div
class="g-recaptcha"
data-sitekey="6LfD3PIbAAAAAJs_eEHvoOl75_83eXSqpPSRFJ_u">
</div>
The site key is:
6LfD3PIbAAAAAJs_eEHvoOl75_83eXSqpPSRFJ_u
reCAPTCHA iframe
The site key may appear in the k parameter:
https://www.google.com/recaptcha/api2/anchor?k=SITE_KEY
reCAPTCHA v3 script
reCAPTCHA v3 often loads the API like this:
<script
src="https://www.google.com/recaptcha/api.js?render=SITE_KEY">
</script>
The site key follows:
render=
grecaptcha.execute
The site key can also appear in JavaScript:
grecaptcha.execute(
"SITE_KEY",
{
action: "login"
}
);
Search the page source and loaded scripts for:
data-sitekey
api2/anchor
api.js?render=
grecaptcha.execute
Browser-console parameter detector
The following script checks common reCAPTCHA locations:
function detectRecaptcha() {
const result = {
siteKey: null,
invisible: false,
callbackName: null,
domain: "google.com",
version: null
};
const element = document.querySelector(
".g-recaptcha[data-sitekey],"
+ "[data-sitekey]"
);
if (element) {
result.siteKey =
element.getAttribute(
"data-sitekey"
);
result.invisible =
element.getAttribute(
"data-size"
) === "invisible";
result.callbackName =
element.getAttribute(
"data-callback"
);
result.version = "v2";
}
const iframe = document.querySelector(
'iframe[src*="/recaptcha/api2/anchor"]'
);
if (iframe) {
try {
const url = new URL(iframe.src);
result.siteKey =
result.siteKey
|| url.searchParams.get("k");
result.invisible =
result.invisible
|| url.searchParams.get("size")
=== "invisible";
result.domain =
url.hostname.includes(
"recaptcha.net"
)
? "recaptcha.net"
: "google.com";
result.version =
result.version || "v2";
} catch {
// Ignore malformed iframe URLs.
}
}
const apiScript = [
...document.scripts
].find((script) =>
script.src.includes(
"recaptcha/api.js?render="
)
);
if (apiScript) {
try {
const url = new URL(
apiScript.src
);
result.siteKey =
url.searchParams.get(
"render"
);
result.domain =
url.hostname.includes(
"recaptcha.net"
)
? "recaptcha.net"
: "google.com";
result.version = "v3";
} catch {
// Ignore malformed script URLs.
}
}
return result;
}
console.log(
detectRecaptcha()
);
This script covers the most common integrations.
Some websites render reCAPTCHA through custom JavaScript, an iframe wrapper, or a framework component. In those cases, inspect the Network panel and loaded scripts.
How to solve reCAPTCHA v2
For standard reCAPTCHA v2, send:
method=userrecaptcha
googlekey=SITE_KEY
pageurl=PAGE_URL
Step 1: Create the task
Example cURL request:
curl --request POST \
--url https://api.solvecaptcha.com/in.php \
--data-urlencode "key=YOUR_API_KEY" \
--data-urlencode "method=userrecaptcha" \
--data-urlencode "googlekey=6LfD3PIbAAAAAJs_eEHvoOl75_83eXSqpPSRFJ_u" \
--data-urlencode "pageurl=https://example.com/login" \
--data-urlencode "json=1"
A successful response contains the task ID:
{
"status": 1,
"request": "2122988149"
}
Save the value from:
request
Step 2: Wait for the result
Wait approximately:
15–20 seconds
before sending the first result request.
Step 3: Retrieve the token
Example:
curl "https://api.solvecaptcha.com/res.php?key=YOUR_API_KEY&action=get&id=2122988149&json=1"
If the task is still processing:
{
"status": 0,
"request": "CAPCHA_NOT_READY"
}
Wait five seconds and repeat the request with the same task ID.
When the task is complete:
{
"status": 1,
"request": "03AFcWeA5dCJ..."
}
The request value contains the reCAPTCHA response token.
Complete Python example for reCAPTCHA v2
Install Requests:
python -m pip install requests
Set the API key:
export SOLVECAPTCHA_API_KEY="YOUR_API_KEY"
Create solve_recaptcha_v2.py:
#!/usr/bin/env python3
from __future__ import annotations
import os
import time
from dataclasses import dataclass
from typing import Any
import requests
CREATE_TASK_URL = (
"https://api.solvecaptcha.com/in.php"
)
GET_RESULT_URL = (
"https://api.solvecaptcha.com/res.php"
)
INITIAL_WAIT_SECONDS = 20
POLL_INTERVAL_SECONDS = 5
MAX_WAIT_SECONDS = 180
class SolveCaptchaError(RuntimeError):
"""Raised when SolveCaptcha returns an error."""
@dataclass(frozen=True)
class RecaptchaSolution:
task_id: str
token: str
def parse_response(
response: requests.Response,
) -> dict[str, Any]:
response.raise_for_status()
try:
result = response.json()
except ValueError as exc:
raise SolveCaptchaError(
"SolveCaptcha returned invalid JSON: "
f"{response.text[:500]}"
) from exc
if not isinstance(result, dict):
raise SolveCaptchaError(
f"Unexpected response: {result!r}"
)
return result
def create_task(
*,
api_key: str,
site_key: str,
page_url: str,
invisible: bool = False,
enterprise: bool = False,
domain: str = "google.com",
action: str | None = None,
min_score: float | None = None,
) -> str:
payload: dict[str, Any] = {
"key": api_key,
"method": "userrecaptcha",
"googlekey": site_key,
"pageurl": page_url,
"domain": domain,
"json": 1,
}
if invisible:
payload["invisible"] = 1
if enterprise:
payload["enterprise"] = 1
if action is not None:
payload["action"] = action
if min_score is not None:
payload["min_score"] = (
min_score
)
response = requests.post(
CREATE_TASK_URL,
data=payload,
timeout=30,
)
result = parse_response(
response
)
if result.get("status") != 1:
raise SolveCaptchaError(
"Task creation failed: "
f"{result.get('request')}"
)
task_id = str(
result.get("request", "")
).strip()
if not task_id:
raise SolveCaptchaError(
"SolveCaptcha did not return "
"a task ID"
)
return task_id
def get_result(
*,
api_key: str,
task_id: str,
) -> str | None:
response = requests.get(
GET_RESULT_URL,
params={
"key": api_key,
"action": "get",
"id": task_id,
"json": 1,
},
timeout=30,
)
result = parse_response(
response
)
if result.get("status") == 1:
token = str(
result.get("request", "")
).strip()
if not token:
raise SolveCaptchaError(
"SolveCaptcha returned "
"an empty token"
)
return token
error_code = str(
result.get(
"request",
"UNKNOWN_ERROR",
)
)
if error_code == "CAPCHA_NOT_READY":
return None
raise SolveCaptchaError(
f"Task failed: {error_code}"
)
def solve_recaptcha(
*,
api_key: str,
site_key: str,
page_url: str,
invisible: bool = False,
enterprise: bool = False,
domain: str = "google.com",
action: str | None = None,
min_score: float | None = None,
) -> RecaptchaSolution:
task_id = create_task(
api_key=api_key,
site_key=site_key,
page_url=page_url,
invisible=invisible,
enterprise=enterprise,
domain=domain,
action=action,
min_score=min_score,
)
time.sleep(
INITIAL_WAIT_SECONDS
)
deadline = (
time.monotonic()
+ MAX_WAIT_SECONDS
)
while time.monotonic() < deadline:
token = get_result(
api_key=api_key,
task_id=task_id,
)
if token is not None:
return RecaptchaSolution(
task_id=task_id,
token=token,
)
time.sleep(
POLL_INTERVAL_SECONDS
)
raise TimeoutError(
f"Task {task_id} was not completed "
f"within {MAX_WAIT_SECONDS} seconds"
)
def main() -> None:
api_key = os.environ.get(
"SOLVECAPTCHA_API_KEY",
"",
).strip()
if not api_key:
raise SystemExit(
"Set SOLVECAPTCHA_API_KEY"
)
solution = solve_recaptcha(
api_key=api_key,
site_key=(
"6LfD3PIbAAAAAJs_eEHvo"
"Ol75_83eXSqpPSRFJ_u"
),
page_url=(
"https://example.com/login"
),
)
print(
"Task ID:",
solution.task_id,
)
print(
"Token:",
solution.token,
)
if __name__ == "__main__":
main()
How to apply a reCAPTCHA v2 token
A standard reCAPTCHA v2 integration usually contains one or more fields named:
g-recaptcha-response
Update every matching field:
function applyRecaptchaToken(token) {
const fields = [
...document.querySelectorAll(
'[name="g-recaptcha-response"]'
)
];
for (const field of fields) {
field.value = token;
field.innerHTML = token;
field.dispatchEvent(
new Event("input", {
bubbles: true
})
);
field.dispatchEvent(
new Event("change", {
bubbles: true
})
);
}
return fields.length;
}
Usage:
applyRecaptchaToken(
"TOKEN_FROM_SOLVECAPTCHA"
);
After inserting the token, continue the page’s normal submission flow.
Prefer:
form.requestSubmit();
instead of:
form.submit();
requestSubmit() triggers the normal submit event and browser validation.
How to solve Invisible reCAPTCHA v2
Invisible reCAPTCHA uses the same base method as standard reCAPTCHA v2.
Add:
invisible=1
Example:
curl --request POST \
--url https://api.solvecaptcha.com/in.php \
--data-urlencode "key=YOUR_API_KEY" \
--data-urlencode "method=userrecaptcha" \
--data-urlencode "googlekey=SITE_KEY" \
--data-urlencode "pageurl=https://example.com/login" \
--data-urlencode "invisible=1" \
--data-urlencode "json=1"
The result is retrieved through the same res.php endpoint.
After receiving the token:
- update
g-recaptcha-response; - dispatch input and change events;
- call the configured callback;
- continue the protected action.
Handling Invisible reCAPTCHA callbacks
The callback name may appear in:
data-callback="onCaptchaSolved"
After applying the token, call:
onCaptchaSolved(
"TOKEN_FROM_SOLVECAPTCHA"
);
For nested callback names:
application.forms.onCaptchaSolved
use:
function resolveCallback(path) {
const value = path
.split(".")
.reduce(
(object, key) =>
object?.[key],
window
);
return typeof value === "function"
? value
: null;
}
const callback = resolveCallback(
"application.forms.onCaptchaSolved"
);
if (callback) {
callback(
"TOKEN_FROM_SOLVECAPTCHA"
);
}
Some websites do not expose the callback globally.
In that case, inspect the page’s normal request in the Network panel. The token may be submitted through:
- a hidden field;
- Fetch;
- XMLHttpRequest;
- a framework state update;
- an application-specific request body.
How to solve reCAPTCHA v3
For reCAPTCHA v3, add:
version=v3
You should also provide:
action
min_score
Example:
curl --request POST \
--url https://api.solvecaptcha.com/in.php \
--data-urlencode "key=YOUR_API_KEY" \
--data-urlencode "method=userrecaptcha" \
--data-urlencode "version=v3" \
--data-urlencode "googlekey=SITE_KEY" \
--data-urlencode "pageurl=https://example.com/login" \
--data-urlencode "action=login" \
--data-urlencode "min_score=0.3" \
--data-urlencode "json=1"
The task ID is returned in:
request
After waiting approximately 15–20 seconds, retrieve the token from res.php.
Understanding min_score
The min_score parameter specifies the score level requested for the task.
Example:
min_score=0.3
It does not mean that the SolveCaptcha result will contain:
{
"score": 0.3
}
SolveCaptcha returns the token.
The actual score is returned by Google later, when the website verifies that token with its private secret key.
The difference is:
min_score = requested score level
score = actual value returned during verification
Request only the score required by the authorized application.
Higher score requirements can reduce task availability and increase processing time.
Using a reCAPTCHA v3 token
The page may send the token through:
g-recaptcha-response;- a form field;
- a JSON request body;
- a custom request parameter;
- a callback.
Inspect the normal browser request to determine the expected location.
The action must match the protected operation.
For example:
Expected action: login
Returned action: search
A website can reject the token even when its score is acceptable.
How to solve reCAPTCHA Enterprise
For reCAPTCHA Enterprise, add:
enterprise=1
Enterprise v2 example
curl --request POST \
--url https://api.solvecaptcha.com/in.php \
--data-urlencode "key=YOUR_API_KEY" \
--data-urlencode "method=userrecaptcha" \
--data-urlencode "googlekey=SITE_KEY" \
--data-urlencode "pageurl=https://example.com/login" \
--data-urlencode "enterprise=1" \
--data-urlencode "json=1"
Enterprise v3 example
curl --request POST \
--url https://api.solvecaptcha.com/in.php \
--data-urlencode "key=YOUR_API_KEY" \
--data-urlencode "method=userrecaptcha" \
--data-urlencode "googlekey=SITE_KEY" \
--data-urlencode "pageurl=https://example.com/login" \
--data-urlencode "version=v3" \
--data-urlencode "enterprise=1" \
--data-urlencode "action=login" \
--data-urlencode "min_score=0.3" \
--data-urlencode "json=1"
Enterprise implementations may also require:
data-s
userAgent
cookies
domain
Use these parameters only when they are present or required by the active website integration.
Optional parameters
domain
Use:
domain=google.com
when the website loads reCAPTCHA from Google.
Use:
domain=recaptcha.net
when the page loads it from recaptcha.net.
The value should match the domain used by the active widget.
data-s
Some Google services include an additional data-s value.
When present, submit:
data-s=VALUE
Do not invent or reuse an old value.
Extract it from the current page or reCAPTCHA request.
userAgent
You can pass the User-Agent used by the active browser:
userAgent=Mozilla/5.0 ...
The value should match the browser session where the token will be used.
cookies
When the task depends on an authenticated or established session, cookies can be submitted in the supported format:
KEY1:Value1;KEY2:Value2;
Do not submit sensitive authentication cookies unless they are genuinely required for an authorized workflow.
proxy and proxytype
When a proxy is required, provide:
proxy=login:password@host:port
proxytype=HTTP
Supported proxy types include:
HTTP
HTTPS
SOCKS4
SOCKS5
Maintain the same network context throughout the workflow when the website associates the captcha with the source IP.
Reporting accepted and rejected solutions
After using the token, report whether it was accepted.
Correct solution:
https://api.solvecaptcha.com/res.php?key=YOUR_API_KEY&action=reportgood&id=TASK_ID
Incorrect solution:
https://api.solvecaptcha.com/res.php?key=YOUR_API_KEY&action=reportbad&id=TASK_ID
Use reportgood when:
- the website accepts the token;
- the protected form succeeds;
- no captcha validation error appears.
Use reportbad only when the returned captcha solution itself is rejected.
Do not send reportbad when the failure was caused by:
- an incorrect site key;
- an incorrect page URL;
- an incorrect action;
- a missing callback;
- an expired page;
- a refreshed widget;
- another invalid form field;
- application validation unrelated to captcha.
Common API errors
ERROR_WRONG_USER_KEY
The SolveCaptcha API key is invalid.
Copy the key again from your account settings.
Check that it does not contain spaces or missing characters.
ERROR_ZERO_BALANCE
The account balance is insufficient.
Add funds before creating another task.
ERROR_CAPTCHA_UNSOLVABLE
The task could not be completed with the submitted parameters.
Check:
- the reCAPTCHA version;
googlekey;pageurl;invisible;version;action;min_score;enterprise;- loading domain.
For reCAPTCHA v3, an excessively high min_score can reduce task availability.
CAPCHA_NOT_READY
The task is still processing.
Wait five seconds and request the result again with the same task ID.
Do not create a duplicate task.
Token rejected
Possible causes include:
- incorrect site key;
- incorrect page URL;
- incorrect action;
- expired token;
- refreshed captcha;
- changed browser session;
- missing callback;
- incorrect response field;
- missing
data-s; - another website-side validation failure.
Common implementation mistakes
Using the wrong API format
Incorrect:
createTask
getTaskResult
clientKey
websiteKey
websiteURL
Correct:
in.php
res.php
key
googlekey
pageurl
Treating reCAPTCHA v3 as Invisible v2
Invisible reCAPTCHA v2 uses:
invisible=1
reCAPTCHA v3 uses:
version=v3
action=ACTION
min_score=SCORE
They are different reCAPTCHA versions.
Omitting the v3 action
Use the exact action found in:
grecaptcha.execute()
Do not guess the action.
Using the wrong loading domain
If the website loads reCAPTCHA from recaptcha.net, pass:
domain=recaptcha.net
Updating only one response field
A page may contain several fields named:
g-recaptcha-response
Update all relevant fields.
Calling only the callback
Some websites also read the hidden response field.
Update the field before calling the callback.
Inserting only the token
Some applications require input events, change events, a callback, or a specific request payload.
Follow the website’s actual submission flow.
Reloading while waiting
Reloading the page can reset the captcha and invalidate the pending token.
Reusing tokens
Treat every token as short-lived and single-use.
Submitting the wrong form
A page can contain several forms.
Use a specific selector instead of:
document.querySelector("form")
Testing applications you control
For automated tests, avoid solving a production captcha on every run.
Use:
- Google test keys;
- mocked verification responses;
- staging-only captcha configuration;
- dedicated test accounts;
- approved test bypasses;
- a limited number of production smoke tests.
Use the real SolveCaptcha workflow when the complete external captcha integration must be tested.
This keeps routine tests faster and more predictable.
Frequently asked questions
Which method is used for Google reCAPTCHA?
Use:
method=userrecaptcha
Which endpoint creates the task?
Use:
https://api.solvecaptcha.com/in.php
Which endpoint retrieves the result?
Use:
https://api.solvecaptcha.com/res.php
Where is the site key sent?
Use:
googlekey=SITE_KEY
Where is the page URL sent?
Use:
pageurl=PAGE_URL
How do I specify Invisible reCAPTCHA?
Add:
invisible=1
How do I specify reCAPTCHA v3?
Add:
version=v3
You should also send the correct action and required min_score.
How do I specify reCAPTCHA Enterprise?
Add:
enterprise=1
How long should I wait?
Wait approximately 15–20 seconds before the first result request.
Poll every five seconds while the response is:
CAPCHA_NOT_READY
Where is the token returned?
With json=1, the completed token is returned in:
request
Where should the token be inserted?
It may be expected in:
g-recaptcha-response;- a callback;
- a form field;
- an XHR or Fetch request;
- an application-specific request parameter.
Inspect the website’s normal workflow.
Can the token be reused?
No.
Treat each token as short-lived and specific to the current task.
Does SolveCaptcha return the actual reCAPTCHA v3 score?
SolveCaptcha returns the token.
The actual score is returned by Google when the website verifies the token on its backend.
Conclusion
Bypassing Google reCAPTCHA with SolveCaptcha begins with identifying the correct version.
The correct process is:
- Confirm whether the page uses reCAPTCHA v2, Invisible v2, v3, or Enterprise.
- Extract the public site key.
- Record the complete page URL.
- Find the action for reCAPTCHA v3.
- Determine whether
invisible=1is required. - Determine whether
enterprise=1is required. - Submit
method=userrecaptchatoin.php. - Save the task ID returned in
request. - Wait approximately 15–20 seconds.
- Poll
res.phpevery five seconds. - Retrieve the token from
request. - Insert the token into the expected field or request.
- Call the callback when required.
- Continue the website’s normal submission flow.
- Report whether the solution was accepted.
Use the SolveCaptcha API documentation to verify the current parameters for each reCAPTCHA version before deploying the integration.