Authdog
Console

Bot Protection

Last updated Sep 9, 2026
View as Markdown

Authdog can require a CAPTCHA check on hosted authentication flows, cutting off automated sign-up, credential stuffing, password-reset spam, and one-time-code abuse at the front door. Two add-ons are available, Google reCAPTCHA and Cloudflare Turnstile. Each is configured per environment, so development and production can run different keys, or no protection at all.

Pick one. If both are enabled for the same flow, reCAPTCHA is used.

Bot protection filters traffic before it authenticates. It complements, but does not replace, Lidar detections and rate limiting.

Protected flows

Attach a check to any of these actions. The same names apply to both add-ons.

Action Flow Visible widget Invisible only
signin Email and password sign-in Yes Yes
signup Email and password sign-up Yes Yes
waitlist Waitlist registration Yes Yes
password_reset Password reset request Yes Yes
magic_link Magic link request — Yes
otp_verify One-time code verification — Yes
otp_resend One-time code resend — Yes
mfa_verify MFA challenge verification — Yes

Selecting no actions protects all of them. An enabled add-on defaults to its broadest coverage.

Visible widget means the page can render a checkbox or Turnstile challenge: reCAPTCHA v2, or Turnstile managed / non-interactive.

Invisible only means the page has no room for a checkbox. Those flows need reCAPTCHA v3, Enterprise, or Turnstile invisible. A v2 or managed widget configured only for those actions does nothing; the request proceeds without a token.

Choose a provider

Google reCAPTCHA Cloudflare Turnstile
Console add-on Authentication > Add-ons > Google reCAPTCHA Authentication > Add-ons > Cloudflare Turnstile
Visible challenge v2 checkbox Managed or non-interactive widget
Invisible / all flows v3 or Enterprise score (0.0–1.0) Invisible mode
Extra knobs Minimum score (v3 / Enterprise, default 0.5) Widget mode must match the Cloudflare widget
Client loader api.js (v2/v3) or enterprise.js (Enterprise) Turnstile widget script
Siteverify google.com/recaptcha/api/siteverify challenges.cloudflare.com/turnstile/v0/siteverify

Use Turnstile when you want a privacy-friendly challenge without image puzzles. Use reCAPTCHA v3 or Enterprise when you want a numeric score you can tighten over time. Keys created in Google Cloud are Enterprise: pick that version and paste the legacy secret key from the Integration tab. Do not enable both providers for the same action unless you intend reCAPTCHA to take over.

Enable reCAPTCHA

Create a reCAPTCHA site in the Google reCAPTCHA admin console first, and add every domain that serves your Authdog authentication pages, including any custom domain. Then, in the Authdog console:

  1. Select the project and environment.
  2. Open Authentication > Add-ons.
  3. Select Google reCAPTCHA.
  4. Choose the version: Enterprise (Google Cloud keys), v3 (classic score-based), or v2 (checkbox challenge).
  5. Enter the site key and the secret key. For Enterprise, use the legacy secret key shown on the Integration tab (third-party / siteverify).
  6. For Enterprise or v3, set the minimum score to accept.
  7. Select which auth flows to protect.
  8. Enable the add-on and save.

The add-on cannot be enabled without a site key. The site key is public and is rendered on the auth pages; the secret key is encrypted at rest, never returned to the browser, and is only decrypted server-side to verify tokens.

v3 and Enterprise score every request from 0.0 (likely a bot) to 1.0 (likely a person) without user interaction. Authdog rejects scores below your minimum. The default is 0.5; a value outside 0.0–1.0 falls back to it. When Google echoes an action name, Authdog requires it to match the flow being attempted, so a token minted on one page cannot be replayed on another.

Enterprise keys come from Google Cloud (Security > reCAPTCHA). Hosted pages load enterprise.js and call grecaptcha.enterprise.execute. Server verification still uses the classic siteverify endpoint with the legacy secret key from the Integration tab — the path Google documents for third-party services. A classic api.js loader will not record traffic against an Enterprise key.

v2 shows the "I'm not a robot" checkbox and returns a pass or fail with no score. It only applies to signin, signup, waitlist, and password_reset.

Start v3 at a permissive minimum, watch how real traffic scores, and tighten from there. Set the bar too high and you reject legitimate users on shared networks and privacy-hardened browsers.

Enable Turnstile

Create a widget in the Cloudflare Turnstile dashboard first, and add every domain that serves your Authdog authentication pages. Then, in the Authdog console:

  1. Select the project and environment.
  2. Open Authentication > Add-ons.
  3. Select Cloudflare Turnstile.
  4. Choose the widget mode: Managed, Non-interactive, or Invisible. This must match the widget you created in Cloudflare.
  5. Enter the site key and the secret key.
  6. Select which auth flows to protect.
  7. Enable the add-on and save.
Widget mode What the user sees Which flows
Managed (recommended) Adaptive challenge; checkbox only when Cloudflare needs a further check signin, signup, waitlist, password_reset
Non-interactive Visible widget with a spinner; no click required Same as managed
Invisible No widget Every flow in the table above

A mode mismatch (for example an Invisible site key saved as Managed) makes Cloudflare reject tokens, and every protected attempt then fails closed.

When Cloudflare echoes an action name, Authdog requires it to match the flow, same as reCAPTCHA v3.

Verification behavior

Authdog verifies every token server-side against the provider's siteverify endpoint, forwarding the client IP when it is known.

The check fails closed when a token is missing or the provider reports it invalid, when a reCAPTCHA v3 score is under the minimum, when the echoed action does not match, or when the add-on is enabled but the secret key is missing or cannot be decrypted. The user sees a verification error and the attempt does not proceed.

The check fails open only when the provider siteverify request itself errors (network or outage). A Google or Cloudflare outage must not lock every user out of an environment. Verify a new configuration with a real sign-in in a non-production environment: if the secret cannot be decrypted, sign-in is blocked until the wrapping key and add-on secret match.

Rollout

  1. Configure and test in development first.
  2. Enable an invisible challenge (reCAPTCHA v3 or Turnstile Invisible) on signup, waitlist, and password_reset, the flows attackers hit first.
  3. Add signin, then magic_link and the one-time-code actions once real traffic looks healthy.
  4. Repeat in production with production-specific keys. Keys are per environment and are not copied between them.

Confirm the reCAPTCHA site or Turnstile widget lists every domain that serves your auth pages, including any custom domain. A domain mismatch makes the provider reject every token, and every protected attempt then fails closed.