- How do I install anhskohbo/no-captcha in a Laravel app?
- Install it with composer require anhskohbo/no-captcha. Laravel 5.5 and above uses package auto-discovery, so no manual provider or alias registration is needed. After installing, add your Google reCAPTCHA keys to .env and render the widget in your form. Laravel 4 users should use the v1 branch instead.
- How do I configure NOCAPTCHA_SITEKEY and NOCAPTCHA_SECRET?
- Add NOCAPTCHA_SECRET and NOCAPTCHA_SITEKEY to your .env file using keys from the Google reCAPTCHA admin console. Laravel 5.5 and above reads these through the package configuration automatically. On older Laravel versions you must publish the config file with artisan vendor:publish. Use separate keys per environment and assign clear ownership for key rotation.
- Do I need to manually register the NoCaptcha service provider and facade alias?
- Only on Laravel versions below 5.5. There you add NoCaptchaServiceProvider to the providers array, the NoCaptcha alias to the aliases array, and publish the config file. Laravel 5.5 and above supports auto-discovery, so you can skip those setup steps. Laravel 4 requires the v1 branch.
- How do I render the reCAPTCHA widget and JavaScript in a Blade form?
- Include {!! NoCaptcha::renderJs() !!} once in your layout or just before the form. Place {!! NoCaptcha::display() !!} inside the form where the widget should appear. The JavaScript call loads Google's reCAPTCHA script, and the display call outputs the widget container. For invisible reCAPTCHA, use the submit-button variant shown in the README.
- How do I validate the reCAPTCHA response with a Laravel validation rule?
- Add 'g-recaptcha-response' => 'required|captcha' to your form request or inline validation rules. The package registers the captcha rule through its service provider, and it verifies the token server-side with Google using your secret key. Make sure the frontend widget or invisible callback actually submits g-recaptcha-response. Then handle validation failures with a clear user-facing message.
- Does this package support invisible reCAPTCHA?
- Yes. The README documents invisible reCAPTCHA using a submit button plus custom attributes such as data-callback and data-size. You render it with NoCaptcha::display() using the appropriate attributes or the submit-button helper. Confirm the callback and auto-submit behavior matches your form's JavaScript. Score-based v3 behavior is a separate concern, so verify whether your version needs a wrapper.
- How do I change the reCAPTCHA language or add custom widget attributes?
- Pass the locale as the first argument to renderJs, for example NoCaptcha::renderJs('fr'). The second and third arguments support explicit onload callbacks. Widget attributes such as data-theme are passed as an array to display(), for example NoCaptcha::display(['data-theme' => 'dark']). Check Google's language and render parameter documentation for supported values.
- How do I test reCAPTCHA validation in Laravel feature tests?
- Mock the NoCaptcha facade in your tests so you never call Google. Bind a fake or use NoCaptcha::shouldReceive to return true from verifyResponse. This keeps CI stable and avoids network dependency or real keys. Then assert that your controller or form request accepts valid submissions and rejects missing or failed tokens.
- Which Laravel, PHP, and Guzzle versions does this package support?
- The package supports Laravel 5 and above, with auto-discovery from Laravel 5.5, and its release notes explicitly cover Laravel 9, 10, 11, and 12. Laravel 4 needs the v1 branch. Guzzle 7 compatibility is noted in the release history, and Lumen is supported. Confirm your exact Laravel, PHP, and Guzzle versions before pinning a release.
- Can I use anhskohbo/no-captcha outside Laravel, such as in Lumen or plain PHP?
- Yes. The README includes a no-Laravel usage example, and Lumen support is available. You can construct the NoCaptcha class directly, render the JavaScript and widget, then call verifyResponse with the submitted token. For API-only flows, document how clients send g-recaptcha-response, since AJAX, WebSocket, and CLI clients do not carry it automatically.