🛒 Bringo

Integrations

reCAPTCHA & Turnstile

Protect login and sensitive forms from bots. The platform supports Google reCAPTCHA v3 and Cloudflare Turnstile — pick one, or leave the provider on Disabled. Configured in Admin → Settings → Google API.

🛡️
The captcha guards the admin login, forgot/reset password, and website auth forms. Turnstile is a privacy-friendly, free alternative to reCAPTCHA.

Option A — Google reCAPTCHA

  1. google.com/recaptcha/admin → register a new site.
  2. Choose reCAPTCHA v3 — v2 ("I'm not a robot") keys are not supported and will fail verification.
  3. Add your domain(s).
  4. Copy the Site Key and Secret Key into Admin → Settings → Google API (the captcha section at the bottom of that tab).

Option B — Cloudflare Turnstile

  1. Cloudflare dashboard → Turnstile → Add site.
  2. Add your domain and create the widget.
  3. Copy the Site Key and Secret Key into Admin → Settings → Google API (the captcha section at the bottom of that tab).
  4. Select Turnstile as the active provider and save.
Captcha settings
Admin → Settings → Google API → captcha section.

Test it

Log out of the admin panel and open the login page — the captcha widget should appear. Submitting without solving it should be blocked.

🔑
Mind the difference: the Site Key is public (rendered in the page); the Secret Key is private (server-side verification). Don't swap them.

Which to choose

reCAPTCHA v3
Invisible, scores each request. No user interaction, but you rely on Google's scoring and it needs a Google account.
reCAPTCHA v2
The familiar checkbox. Visible friction, but easy for users to understand when it blocks them.
Cloudflare Turnstile
Privacy-focused, free, usually invisible, and does not require a Google account. A good default if you already use Cloudflare.

Whichever you pick, the secret key stays on the server and the site key is public — never swap the two fields.

Troubleshooting

Widget does not appear
Wrong site key, the provider is not enabled, or a content blocker is hiding the frame. Test in a clean private window.
"Invalid domain for site key"
Your domain is not listed in the key's allowed domains at the provider. Add both the apex and www forms if you use both.
Always fails verification
Site key and secret key are swapped, or they belong to two different sites at the provider.
Locked out of your own admin login
Disable the captcha in the database: set its enable flag to 0 in the settings table, then clear cache with php artisan config:clear.
Real users blocked (v3)
The score threshold is too aggressive for your audience. Lower it, or switch to the v2 checkbox so people can prove themselves.
👉
Next: AI Assistant.