Captcha solving service blog | SolveCaptcha How to request scores from reCAPTCHA v3 with SolveCaptcha

reCAPTCHA

How to request scores from reCAPTCHA v3 with solver

24.07.2026

Juan Sebastian Tech builder creating reliable infrastructure, automation, backend systems, and scalable SaaS products

reCAPTCHA v3 works silently in the background. It does not display a checkbox or ask users to select images. Instead, it generates a token that the website verifies on its server.

During verification, Google returns a score that represents how trustworthy the interaction appears. The website uses this score, together with the expected action and its own security rules, to decide whether the request should be accepted, challenged, or rejected.

With the SolveCaptcha API, you can request a reCAPTCHA v3 token for a specific page, action, and minimum score.

The complete process is:

Find the site key and action
→ request a token with min_score
→ wait for SolveCaptcha to process the task
→ retrieve the token
→ submit it to the target website
→ verify it with Google
→ read the actual score

One distinction is especially important:

min_score = the score level requested from SolveCaptcha
score = the value returned by Google during verification

SolveCaptcha returns a reCAPTCHA token. It does not normally return the final Google score in the task result.

The actual score becomes available only when the website verifies the token with Google using its private reCAPTCHA secret key.

Use this method only on websites you own or are authorized to test and automate.

How reCAPTCHA v3 scoring works

A standard reCAPTCHA v3 flow has two parts: token generation in the browser and token verification on the server.

The process usually looks like this:

The browser performs an action
→ reCAPTCHA generates a token
→ the browser sends the token to the website
→ the website sends the token to Google
→ Google returns a score and action
→ the website applies its security policy

A Google verification response may look like this:

{
  "success": true,
  "score": 0.7,
  "action": "login",
  "challenge_ts": "2026-07-24T12:00:00Z",
  "hostname": "example.com"
}

The website can then apply its own rules.

For example:

score >= 0.7 → allow the request
score >= 0.3 → request additional verification
score < 0.3 → reject the request

These thresholds are controlled by the website owner. There is no universal score that guarantees access on every website.

One application may accept a score of 0.3 for viewing public content but require 0.7 for logging in, creating an account, or confirming a payment.

Requesting a score and reading a score are different operations

The SolveCaptcha request includes the parameter:

min_score

For example:

min_score=0.3

This tells SolveCaptcha which score level is required for the requested token.

It does not mean that the SolveCaptcha result will contain a field such as:

{
  "score": 0.3
}

A completed SolveCaptcha response normally contains only the token:

{
  "status": 1,
  "request": "03AFcWeA5dCJ..."
}

The token must then be submitted to the protected website. The website verifies it with Google and receives the actual score.

This distinction matters when testing an integration:

min_score is part of the SolveCaptcha task request;
the token is returned by SolveCaptcha;
the actual score is returned by Google to the website backend.

Common reCAPTCHA v3 score levels

reCAPTCHA v3 scores generally represent different levels of confidence.

Score	General interpretation
`0.9`	Very likely to be a legitimate interaction
`0.7`	Likely to be legitimate
`0.5`	Uncertain
`0.3`	Low-confidence interaction
`0.1`	Very suspicious interaction

These descriptions are only general guidelines.

The website decides how to interpret each score. It may also consider:

the expected action;
account history;
IP reputation;
request frequency;
authentication state;
device information;
previous failed attempts;
application-specific risk rules.

A valid token with an acceptable score can still be rejected when another part of the request fails validation.

Why the action matters

reCAPTCHA v3 associates each token with an action.

Common action names include:

login
register
checkout
search
contact
verify
submit

The action is usually passed to grecaptcha.execute():

grecaptcha.execute(
  "SITE_KEY",
  {
    action: "login"
  }
);

When Google verifies the token, it returns the action associated with it.

The website should compare the returned action with the action it expected.

For example:

Expected action: login
Returned action: homepage

Even if the token has a high score, the website may reject it because it was generated for the wrong action.

Always use the exact action found in the website’s JavaScript. Do not guess between similar values such as:

login
signin
sign_in
authenticate
verify

How to check a reCAPTCHA score without writing code

You can test how reCAPTCHA evaluates a browser session by opening the reCAPTCHA v3 demo page.

The page may display a result such as:

Score: 0.7

You can repeat the test using:

different browsers;
normal and automated sessions;
new and established browser profiles;
different network connections;
different browser configurations.

This can help you compare how changes to the environment affect the score.

However, the result applies only to the demo integration. It does not guarantee that another website will return the same score or use the same acceptance threshold.

Each website has its own:

site key;
action names;
traffic history;
backend rules;
security thresholds.

Required SolveCaptcha parameters

Create the reCAPTCHA v3 task through:

POST https://api.solvecaptcha.com/in.php

The main parameters are:

Parameter	Required	Description
`key`	Yes	Your SolveCaptcha API key
`method`	Yes	Must be `userrecaptcha`
`version`	Yes	Must be `v3`
`googlekey`	Yes	Public reCAPTCHA site key
`pageurl`	Yes	Full URL of the protected page
`action`	Recommended	Action expected by the website
`min_score`	No	Requested minimum score
`domain`	No	`google.com` or `recaptcha.net`
`json`	Recommended	Set to `1` for JSON responses

The documented default value for min_score is:

0.4

In practice, higher score requirements can reduce solution availability. Request only the score that the application actually requires.

A practical starting value is often:

min_score=0.3

How to find the site key

reCAPTCHA v3 commonly loads its JavaScript API with a public site key in the render parameter.

Example:

<script
  src="https://www.google.com/recaptcha/api.js?render=6LfB5_IbAAAAAMCtsjEHEHKqcB9iQocwwxTiihJu">
</script>

The site key is:

6LfB5_IbAAAAAMCtsjEHEHKqcB9iQocwwxTiihJu

The same value may appear in a grecaptcha.execute() call:

grecaptcha.execute(
  "6LfB5_IbAAAAAMCtsjEHEHKqcB9iQocwwxTiihJu",
  {
    action: "login"
  }
);

To find it, search the page source and loaded scripts for:

api.js?render=
grecaptcha.execute
data-sitekey

The site key is public and is not the same as the private reCAPTCHA secret used for server-side verification.

How to find the action

The action is usually passed inside the options object of grecaptcha.execute().

Example:

grecaptcha.execute(
  "SITE_KEY",
  {
    action: "checkout"
  }
);

The corresponding SolveCaptcha parameter is:

action=checkout

The action may be different for each protected operation on the same website.

For example:

grecaptcha.execute(
  "SITE_KEY",
  {
    action: "login"
  }
);

and:

grecaptcha.execute(
  "SITE_KEY",
  {
    action: "password_reset"
  }
);

Use the action associated with the exact request you are automating.

Step 1: Create a reCAPTCHA v3 task

Send a POST request to:

https://api.solvecaptcha.com/in.php

Example:

curl --request POST \
  --url https://api.solvecaptcha.com/in.php \
  --data-urlencode "key=YOUR_API_KEY" \
  --data-urlencode "method=userrecaptcha" \
  --data-urlencode "version=v3" \
  --data-urlencode "googlekey=6LfB5_IbAAAAAMCtsjEHEHKqcB9iQocwwxTiihJu" \
  --data-urlencode "pageurl=https://example.com/login" \
  --data-urlencode "action=login" \
  --data-urlencode "min_score=0.3" \
  --data-urlencode "domain=google.com" \
  --data-urlencode "json=1"

A successful response contains the task ID:

{
  "status": 1,
  "request": "2122988149"
}

Save the value from request. It is required to retrieve the solution.

If task creation fails, the API returns an error:

{
  "status": 0,
  "request": "ERROR_CODE"
}

Do not begin polling unless a valid task ID was returned.

Step 2: Wait before requesting the result

reCAPTCHA v3 tasks usually require some processing time.

Wait approximately:

15–20 seconds

before sending the first result request.

Creating duplicate tasks while the first task is still processing increases costs and makes debugging more difficult.

Step 3: Retrieve the token

Request the result from:

GET https://api.solvecaptcha.com/res.php

Example:

curl "https://api.solvecaptcha.com/res.php?key=YOUR_API_KEY&action=get&id=2122988149&json=1"

If the token is not ready, the response contains:

{
  "status": 0,
  "request": "CAPCHA_NOT_READY"
}

Wait five seconds and repeat the request using the same task ID.

When processing is complete, the API returns:

{
  "status": 1,
  "request": "03AFcWeA5dCJ..."
}

The value in request is the reCAPTCHA token.

It is not the actual Google score.

Complete Python example

Install Requests:

python -m pip install requests

Set the API key in an environment variable:

export SOLVECAPTCHA_API_KEY="YOUR_API_KEY"

Create request_recaptcha_v3.py:

#!/usr/bin/env python3

from __future__ import annotations

import os
import time
from dataclasses import dataclass
from typing import Any

import requests

CREATE_TASK_URL = (
    "https://api.solvecaptcha.com/in.php"
)

GET_RESULT_URL = (
    "https://api.solvecaptcha.com/res.php"
)

INITIAL_WAIT_SECONDS = 20
POLL_INTERVAL_SECONDS = 5
MAX_WAIT_SECONDS = 180

class SolveCaptchaError(RuntimeError):
    """Raised when SolveCaptcha returns an error."""

@dataclass(frozen=True)
class RecaptchaV3Solution:
    task_id: str
    token: str
    requested_score: float
    action: str

def parse_response(
    response: requests.Response,
) -> dict[str, Any]:
    response.raise_for_status()

    try:
        result = response.json()
    except ValueError as exc:
        raise SolveCaptchaError(
            "SolveCaptcha returned invalid JSON: "
            f"{response.text[:500]}"
        ) from exc

    if not isinstance(result, dict):
        raise SolveCaptchaError(
            f"Unexpected response: {result!r}"
        )

    return result

def create_task(
    *,
    api_key: str,
    site_key: str,
    page_url: str,
    action: str,
    min_score: float,
) -> str:
    response = requests.post(
        CREATE_TASK_URL,
        data={
            "key": api_key,
            "method": "userrecaptcha",
            "version": "v3",
            "googlekey": site_key,
            "pageurl": page_url,
            "action": action,
            "min_score": min_score,
            "domain": "google.com",
            "json": 1,
        },
        timeout=30,
    )

    result = parse_response(
        response
    )

    if result.get("status") != 1:
        raise SolveCaptchaError(
            "Task creation failed: "
            f"{result.get('request')}"
        )

    task_id = str(
        result.get("request", "")
    ).strip()

    if not task_id:
        raise SolveCaptchaError(
            "SolveCaptcha did not return "
            "a task ID"
        )

    return task_id

def get_result(
    *,
    api_key: str,
    task_id: str,
) -> str | None:
    response = requests.get(
        GET_RESULT_URL,
        params={
            "key": api_key,
            "action": "get",
            "id": task_id,
            "json": 1,
        },
        timeout=30,
    )

    result = parse_response(
        response
    )

    if result.get("status") == 1:
        token = str(
            result.get("request", "")
        ).strip()

        if not token:
            raise SolveCaptchaError(
                "SolveCaptcha returned "
                "an empty token"
            )

        return token

    error_code = str(
        result.get(
            "request",
            "UNKNOWN_ERROR",
        )
    )

    if error_code == "CAPCHA_NOT_READY":
        return None

    raise SolveCaptchaError(
        f"Task failed: {error_code}"
    )

def solve_recaptcha_v3(
    *,
    api_key: str,
    site_key: str,
    page_url: str,
    action: str,
    min_score: float,
) -> RecaptchaV3Solution:
    task_id = create_task(
        api_key=api_key,
        site_key=site_key,
        page_url=page_url,
        action=action,
        min_score=min_score,
    )

    time.sleep(
        INITIAL_WAIT_SECONDS
    )

    deadline = (
        time.monotonic()
        + MAX_WAIT_SECONDS
    )

    while time.monotonic() < deadline:
        token = get_result(
            api_key=api_key,
            task_id=task_id,
        )

        if token is not None:
            return RecaptchaV3Solution(
                task_id=task_id,
                token=token,
                requested_score=min_score,
                action=action,
            )

        time.sleep(
            POLL_INTERVAL_SECONDS
        )

    raise TimeoutError(
        f"Task {task_id} was not completed "
        f"within {MAX_WAIT_SECONDS} seconds"
    )

def main() -> None:
    api_key = os.environ.get(
        "SOLVECAPTCHA_API_KEY",
        "",
    ).strip()

    if not api_key:
        raise SystemExit(
            "Set SOLVECAPTCHA_API_KEY"
        )

    solution = solve_recaptcha_v3(
        api_key=api_key,
        site_key=(
            "6LfB5_IbAAAAAMCtsjEHEHK"
            "qcB9iQocwwxTiihJu"
        ),
        page_url=(
            "https://example.com/login"
        ),
        action="login",
        min_score=0.3,
    )

    print(
        "Task ID:",
        solution.task_id,
    )

    print(
        "Requested score:",
        solution.requested_score,
    )

    print(
        "Action:",
        solution.action,
    )

    print(
        "Token:",
        solution.token,
    )

if __name__ == "__main__":
    main()

The output may contain:

Task ID: 2122988149
Requested score: 0.3
Action: login
Token: 03AFcWeA5dCJ...

The displayed requested score is the value submitted through min_score. It is not the final score returned by Google.

How to read the actual Google score

The actual score becomes available only when the website backend verifies the token with Google.

This requires the website’s private reCAPTCHA secret key.

You can perform this verification only when:

you own the reCAPTCHA integration;
you have authorized access to the backend;
you have the correct private secret key.

Never place the secret key in:

browser JavaScript;
mobile application code;
public repositories;
client-side configuration;
downloadable scripts.

The secret key must remain on the server.

Example Python verification:

from __future__ import annotations

from typing import Any

import requests

VERIFY_URL = (
    "https://www.google.com/"
    "recaptcha/api/siteverify"
)

def verify_recaptcha_token(
    *,
    secret_key: str,
    token: str,
    expected_action: str,
) -> dict[str, Any]:
    response = requests.post(
        VERIFY_URL,
        data={
            "secret": secret_key,
            "response": token,
        },
        timeout=30,
    )

    response.raise_for_status()
    result = response.json()

    if not result.get("success"):
        raise RuntimeError(
            "Google rejected the token: "
            f"{result.get('error-codes', [])}"
        )

    returned_action = result.get(
        "action"
    )

    if returned_action != expected_action:
        raise RuntimeError(
            "Action mismatch: "
            f"expected {expected_action!r}, "
            f"received {returned_action!r}"
        )

    return result

Usage:

verification = verify_recaptcha_token(
    secret_key="YOUR_RECAPTCHA_SECRET",
    token=solution.token,
    expected_action="login",
)

print(
    "Actual score:",
    verification.get("score"),
)

print(
    "Verified action:",
    verification.get("action"),
)

print(
    "Hostname:",
    verification.get("hostname"),
)

Example output:

Actual score: 0.7
Verified action: login
Hostname: example.com

This is the point at which the actual score becomes available.

Why the score cannot be read directly from SolveCaptcha

Google sends the score to the website’s server-side verification request. It does not send it to the browser that generated the token.

The verification request requires the website’s private secret key.

As a result, you normally cannot read the score for a third-party website unless:

the website displays it;
its API returns it;
you have authorized backend access;
it provides a public testing page.

The token itself should be treated as an opaque value. Do not attempt to decode it to obtain the score.

Requested score versus verified score

Consider the following SolveCaptcha request:

min_score=0.3

SolveCaptcha returns:

{
  "status": 1,
  "request": "TOKEN"
}

The website may later verify the token and receive:

{
  "success": true,
  "score": 0.3,
  "action": "login"
}

The values have different purposes:

Value	Source	Meaning
`min_score`	SolveCaptcha request	Requested score level
`request`	SolveCaptcha result	reCAPTCHA response token
`score`	Google verification response	Score assigned during verification
`action`	Google verification response	Action associated with the token

Do not use min_score as proof that Google returned the same value.

How to choose min_score

Do not automatically request the highest available score.

Start with the minimum score accepted by the application.

For example:

min_score=0.3

If the application requires:

score >= 0.7

then a lower-scoring token will not satisfy its policy.

However, requesting a higher score can:

increase processing time;
reduce task availability;
increase the chance of an unsolvable response;
make the integration less stable.

The SolveCaptcha documentation notes that receiving tokens above 0.3 can be difficult.

Use the lowest score that satisfies the actual policy of the authorized application.

How the website should validate the result

A secure reCAPTCHA v3 integration should validate more than success.

It should check:

whether verification succeeded;
whether the score meets the required threshold;
whether the returned action matches;
whether the hostname is correct;
whether the token is fresh;
whether the token has already been used.

Example:

def validate_recaptcha_result(
    verification: dict,
    *,
    expected_action: str,
    minimum_score: float,
    expected_hostname: str,
) -> None:
    if not verification.get("success"):
        raise PermissionError(
            "reCAPTCHA verification failed"
        )

    if (
        verification.get("action")
        != expected_action
    ):
        raise PermissionError(
            "Unexpected reCAPTCHA action"
        )

    if (
        float(
            verification.get(
                "score",
                0,
            )
        )
        < minimum_score
    ):
        raise PermissionError(
            "reCAPTCHA score is too low"
        )

    if (
        verification.get("hostname")
        != expected_hostname
    ):
        raise PermissionError(
            "Unexpected reCAPTCHA hostname"
        )

A high score should not override an incorrect action or hostname.

Common errors

ERROR_WRONG_USER_KEY

The SolveCaptcha API key is invalid.

Copy the API key again from your account settings and confirm that no extra spaces were included.

ERROR_ZERO_BALANCE

The account does not have enough balance to create a new task.

Add funds before retrying.

ERROR_CAPTCHA_UNSOLVABLE

The task could not be completed with the supplied parameters.

Check:

googlekey;
pageurl;
version=v3;
action;
min_score;
loading domain.

A high min_score can significantly reduce solution availability.

CAPCHA_NOT_READY

The task is still being processed.

Wait five seconds and request the result again using the same task ID.

Token is valid but the score is too low

A token can pass basic verification while failing the website’s score threshold.

Confirm the minimum score required by the application and request the appropriate min_score.

A higher requested value still does not guarantee acceptance because the website can apply additional checks.

Action mismatch

The action in the SolveCaptcha request does not match the action expected by the website.

Inspect the exact grecaptcha.execute() call associated with the protected operation.

Token rejected as expired

reCAPTCHA tokens are short-lived.

Use the token immediately after receiving it and do not store it for later requests.

Common implementation mistakes

Expecting a score in the SolveCaptcha result

Incorrect expectation:

{
  "status": 1,
  "request": "TOKEN",
  "score": 0.7
}

The standard SolveCaptcha result contains the token, not the verified Google score.

Confusing min_score with score

min_score is a task parameter. It is not the final verification result.

Omitting version=v3

A reCAPTCHA v3 request must contain:

version=v3

Without it, the task may be processed as another reCAPTCHA type.

Guessing the action

Use the exact action from the website’s JavaScript.

Do not replace:

password_reset

with:

verify

unless the application actually uses that value.

Using createTask and getTaskResult

The documented SolveCaptcha endpoints are:

https://api.solvecaptcha.com/in.php

and:

https://api.solvecaptcha.com/res.php

Trying to read the score in browser JavaScript

The browser receives the token. The score is returned to the website backend during verification.

Publishing the secret key

The reCAPTCHA secret key must remain private and server-side.

Requesting min_score=0.9 by default

Request only the score required by the application. Higher score levels may be difficult or unavailable.

Reusing a token

Treat every token as short-lived and single-use.

Ignoring the action

A token with an acceptable score can still be rejected when its action does not match.

Frequently asked questions

Can SolveCaptcha return the actual reCAPTCHA score?

The standard SolveCaptcha response returns a token. Google returns the actual score when the website verifies that token.

What does min_score mean?

It defines the score level requested for the SolveCaptcha task.

What is the default min_score?

The documented default is:

0.4

Which min_score should I use?

Use the lowest score accepted by the authorized target application.

A common starting value is:

0.3

Can I request a score of 0.9?

You can specify a higher score, but solution availability may be limited. The documentation notes that scores above 0.3 can be difficult to obtain.

How can I find the required score?

For an application you own, inspect the backend verification policy.

For a third-party website, the threshold may not be publicly available.

Can I read the score from the token?

No. Treat the token as an opaque value.

Can I verify a token without the secret key?

No. Server-side verification requires the private reCAPTCHA secret key.

Does a valid token guarantee that the request will succeed?

No. The website may reject the request because of:

a low score;
an incorrect action;
a hostname mismatch;
an expired token;
a reused token;
application-specific validation.

How often should I poll SolveCaptcha?

Wait approximately 15–20 seconds before the first request. Continue polling every five seconds while the API returns CAPCHA_NOT_READY.

Conclusion

Requesting a reCAPTCHA v3 score and reading the verified score are separate operations.

The correct workflow is:

Confirm that the page uses reCAPTCHA v3.
Extract the public site key.
Find the exact action used by the protected operation.
Submit method=userrecaptcha.
Set version=v3.
Pass the site key as googlekey.
Pass the complete page URL as pageurl.
Specify the required min_score.
Save the task ID returned in request.
Wait approximately 15–20 seconds.
Poll res.php every five seconds.
Read the completed token from request.
Submit the token to the authorized website backend.
Verify the token with Google using the private secret key.
Read the actual score, action, and hostname from Google’s response.

Use the SolveCaptcha reCAPTCHA v3 documentation to verify the current request parameters and the reCAPTCHA v3 demo to test score behavior without building a complete integration.