4

Below is my implementation of ReCaptcha V2 in my Android app. When I run it, it returns: Error message: unknown status code: 12008

This means the following:

public static final int RECAPTCHA_INVALID_KEYTYPE Cannot start the reCAPTCHA service because type of site key is not valid.

Please register new site key with the key type set to "reCAPTCHA Android" via //g.co/recaptcha/androidsignup.

Constant Value: 12008

My site key is available on my ReCaptcha admin portal, so what do I need to do for it to be 'valid'?

The code example that I've implemented does include the following comments regarding the server url:

//it is google recaptcha siteverify server
//you can place your server url

Is this a requirement or a suggestion?

public void onCaptchaClick(View view) {
    SafetyNet.getClient(this).verifyWithRecaptcha(SITE_KEY)
            .addOnSuccessListener(this, new OnSuccessListener<SafetyNetApi.RecaptchaTokenResponse>() {
                @Override
                public void onSuccess(SafetyNetApi.RecaptchaTokenResponse response) {
                    if (!response.getTokenResult().isEmpty()) {
                        handleSiteVerify(response.getTokenResult());
                    }
                }
            })
            .addOnFailureListener(this, new OnFailureListener() {
                @Override
                public void onFailure(@NonNull Exception e) {
                    if (e instanceof ApiException) {
                        ApiException apiException = (ApiException) e;
                        Log.d(TAG, "Error message: " +
                                CommonStatusCodes.getStatusCodeString(apiException.getStatusCode()));
                    } else {
                        Log.d(TAG, "Unknown type of error: " + e.getMessage());
                    }
                }
            });

}


protected  void handleSiteVerify(final String responseToken){
    //it is google recaptcha siteverify server
    //you can place your server url
    String url = "https://www.google.com/recaptcha/api/siteverify";
    StringRequest request = new StringRequest(Request.Method.POST, url,
            new Response.Listener<String>() {
                @Override
                public void onResponse(String response) {
                    try {
                        JSONObject jsonObject = new JSONObject(response);
                        if(jsonObject.getBoolean("success")){
                            Toast.makeText(getApplicationContext(),String.valueOf(jsonObject.getBoolean("success")),Toast.LENGTH_LONG).show();
                        }
                        else{
                            Toast.makeText(getApplicationContext(),String.valueOf(jsonObject.getString("error-codes")),Toast.LENGTH_LONG).show();
                        }
                    } catch (Exception ex) {
                        Log.d(TAG, "JSON exception: " + ex.getMessage());

                    }
                }
            },
            new Response.ErrorListener() {
                @Override
                public void onErrorResponse(VolleyError error) {
                    Log.d(TAG, "Error message: " + error.getMessage());
                }
            }) {
        @Override
        protected Map<String, String> getParams() {
            Map<String, String> params = new HashMap<>();
            params.put("secret", SECRET_KEY);
            params.put("response", responseToken);
            return params;
        }
    };
    request.setRetryPolicy(new DefaultRetryPolicy(
            50000,
            DefaultRetryPolicy.DEFAULT_MAX_RETRIES,
            DefaultRetryPolicy.DEFAULT_BACKOFF_MULT));
    queue.add(request);
}

1 Answer 1

6

This error means that you are not using the right key.

Have you created an Android app key or a website key? I got this error when I tried to use the web key for the app, you need an Android app key.

3
  • 1
    That was exactly my issue. Thanks. Unrelated to my mistake, what is confusing is that the text above the site key for Android states: "Use this site key in the HTML code your site serves to users." Commented Oct 3, 2020 at 20:51
  • That was surely copied-pasted from the original site that was web-only. Also, remember to send the response key to the server and validate it via PHP, otherwise you'll get a warning in the panel and your validation won't be 100% secure.
    – andreszs
    Commented Oct 4, 2020 at 11:37
  • 1
    Anyone wondering where to you find the android key: you have to switch a classic key then select v2 -> Android key and type in your package name
    – apouche
    Commented Nov 10, 2023 at 10:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.