25 lines (19 loc) · 658 Bytes

reCAPTCHA

To protect sensitive actions from abuse, configure Google reCAPTCHA v2 (invisible). You can register for credentials here.

Copy the values from Google into recaptcha.siteKey and recaptcha.secretKey (or RCTF_RECAPTCHA_SITE_KEY and RCTF_RECAPTCHA_SECRET_KEY).

You must also set recaptcha.protectedActions to a list of actions that require a token. Valid values are:

register
recover
setEmail

Example configuration to protect registration and auth recovery endpoints:

recaptcha:
  siteKey: AAA
  secretKey: BBB
  protectedActions:
    - register
    - recover