lool – only 2 minutes after i posted that, I get the following output and everything is working again.
I last changed the API restrictions and specified the referrer IP as my servers WAN IP and it’s working.
However you documentation and guides are out of date – Google now force you to use the Cloud Console and generate a Service Worker Account as well as many other things.
So please consider updating your documentation (try to follow your current guide on a new setup and it will NOT work)
[2026-01-08T01:20:28+00:00] Parsed: valid=NULL invalidReason= score=NULL errorMessage=Requests from this referer are blocked.
[2026-01-08T01:27:56+00:00] HTTP OUT: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:27:56+00:00] HTTP OUT body: {“event”:{“token”:”REDACTED(len=1700)”,”siteKey”:”6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,”expectedAction”:”DOWNLOAD”}}
[2026-01-08T01:27:56+00:00] HTTP IN: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:27:56+00:00] HTTP IN code: 200
[2026-01-08T01:27:56+00:00] HTTP IN body: {
“name”: “projects/REDACTED/assessments/891e7e4369000000”,
“event”: {
“token”: “REDACTED”,
“siteKey”: “6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,
“userAgent”: “”,
“userIpAddress”: “”,
“expectedAction”: “DOWNLOAD”,
“hashedAccountId”: “”,
“express”: false,
“requestedUri”: “”,
“wafTokenAssessment”: false,
“ja3”: “”,
“ja4”: “”,
“headers”: [],
“firewallPolicyEvaluation”: false,
“fraudPrevention”: “FRAUD_PREVENTION_UNSPECIFIED”
},
“riskAnalysis”: {
“score”: 0.9,
“reasons”: [],
“extendedVerdictReasons”: [],
“challenge”: “CHALLENGE_UNSPECIFIED”,
“verifiedBots”: []
},
“tokenProperties”: {
“valid”: true,
“invalidReason”: “INVALID_REASON_UNSPECIFIED”,
“hostname”: “www.bmsworld.nz”,
“androidPackageName”: “”,
“iosBundleId”: “”,
“action”: “”,
“createTime”: “2026-01-08T01:21:28.442Z”
},
“accountDefenderAssessment”: {
“labels”: []
}
}
[2026-01-08T01:27:56+00:00] Parsed: valid=true invalidReason=INVALID_REASON_UNSPECIFIED score=0.9 errorMessage=
[2026-01-08T01:28:42+00:00] HTTP OUT: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:28:42+00:00] HTTP OUT body: {“event”:{“token”:”REDACTED(len=1700)”,”siteKey”:”6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,”expectedAction”:”DOWNLOAD”}}
[2026-01-08T01:28:42+00:00] HTTP IN: https://recaptchaenterprise.googleapis.com/v1/projects/bmsworld-REDACTED-1767830430885/assessments?key=REDACTED
[2026-01-08T01:28:42+00:00] HTTP IN code: 200
[2026-01-08T01:28:42+00:00] HTTP IN body: {
“name”: “projects/REDACTED/assessments/ffc4be4369000000”,
“event”: {
“token”: “REDACTED”,
“siteKey”: “6Ldhd0MsAAAAAO-REDACTED-Om-BKnrH9MoivmDoOMH”,
“userAgent”: “”,
“userIpAddress”: “”,
“expectedAction”: “DOWNLOAD”,
“hashedAccountId”: “”,
“express”: false,
“requestedUri”: “”,
“wafTokenAssessment”: false,
“ja3”: “”,
“ja4”: “”,
“headers”: [],
“firewallPolicyEvaluation”: false,
“fraudPrevention”: “FRAUD_PREVENTION_UNSPECIFIED”
},
“riskAnalysis”: {
“score”: 0.9,
“reasons”: [],
“extendedVerdictReasons”: [],
“challenge”: “CHALLENGE_UNSPECIFIED”,
“verifiedBots”: []
},
“tokenProperties”: {
“valid”: true,
“invalidReason”: “INVALID_REASON_UNSPECIFIED”,
“hostname”: “www.bmsworld.nz”,
“androidPackageName”: “”,
“iosBundleId”: “”,
“action”: “”,
“createTime”: “2026-01-08T01:28:28.018Z”
},
“accountDefenderAssessment”: {
“labels”: []
}
}
[2026-01-08T01:28:42+00:00] Parsed: valid=true invalidReason=INVALID_REASON_UNSPECIFIED score=0.9 errorMessage=
.
