projects

PATCH /v1/projects/{projectsId}/apps/{appsId}/recaptchaV3Config

Changed on Nov 2, 2026

Updates the RecaptchaV3Config for the specified app. While this configuration is incomplete or invalid, the app will be unable to exchange reCAPTCHA v3 tokens for App Check tokens. For security reasons, the site_secret field is never populated in the response.

Request

Base URL
https://firebaseappcheck.googleapis.com
URL
https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}/recaptchaV3Config
Auth
- OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/cloud-platform
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform
- or OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/firebase
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/firebase

Path parameters

projectsIdstring required

appsIdstring required

Query parameters

updateMaskstring google-fieldmask

Required. A comma-separated list of names of fields in the RecaptchaV3Config to update. Example: site_secret.

Request body

minValidScorenumber float

Specifies a minimum score required for a reCAPTCHA token to be considered valid. If its score is greater than or equal to this value, it will be accepted; otherwise, it will be rejected. The value must be between 0.0 and 1.0. The default value is 0.5.

namestring

Required. The relative resource name of the reCAPTCHA v3 configuration object, in the format: projects/{project_number}/apps/{app_id}/recaptchaV3Config

siteSecretstring

Required. Input only. The site secret used to identify your service for reCAPTCHA v3 verification. For security reasons, this field will never be populated in any response.

siteSecretSetboolean

Output only. Whether the site_secret field was previously set. Since we will never return the site_secret field, this field is the only way to find out whether it was previously set.

tokenTtlstring google-duration

Specifies the duration for which App Check tokens exchanged from reCAPTCHA tokens will be valid. If unset, a default value of 1 day is assumed. Must be between 30 minutes and 7 days, inclusive.

Response

Successful response