Method: projects.apps.exchangeRecaptchaV3Token

Validates a reCAPTCHA v3 response token . If valid, returns an AppCheckToken .

HTTP request

POST https://firebaseappcheck.googleapis.com/v1/{app=projects/*/apps/*}:exchangeRecaptchaV3Token

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
app

string

Required. The relative resource name of the web app, in the format:

projects/{project_number}/apps/{app_id}

If necessary, the project_number element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's AIP 2510 standard.

Request body

The request body contains data with the following structure:

JSON representation
{"recaptchaV3Token":string,"limitedUse":boolean}
Fields
recaptchaV3Token

string

Required. The reCAPTCHA token as returned by the reCAPTCHA v3 JavaScript API .

limitedUse

boolean

Specifies whether this attestation is for use in a limited use ( true ) or session based ( false ) context. To enable this attestation to be used with the replay protection feature, set this to true . The default value is false .

Response body

If successful, the response body contains an instance of AppCheckToken .

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-09-25 UTC.