Recaptcha Enterprise Bundle Laravel Package

Product Decisions This Supports

• Bot and fraud mitigation on high-value flows — signup, login, password reset, checkout, promo redemption, and lead forms can be gated on a Google reCAPTCHA Enterprise risk score rather than a binary checkbox. This is a product decision about where friction goes, not just a security toggle.
• Build vs. buy on risk scoring — the alternative is hand-rolling a client for Google's Enterprise assessment API (service account auth, project-scoped endpoints, token assessment, error mapping) plus a Laravel validation rule. This package is a thin integration layer; adopting it is a bet that the wrapper is cheaper to own than ~a few hundred lines of in-house glue.
• Platform migration / roadmap — Google has been steering new integrations toward Enterprise keys and away from legacy v2/v3 site keys. If the roadmap includes re-enterprise-ing an existing reCAPTCHA integration, evaluating a package at this point is a reasonable pre-work item rather than a sprint commitment.
• Tuning risk thresholds as a product lever — score-based assessment enables segment-level policy: strict on account creation and payment, lenient on content reads. That supports decisions about false-positive tolerance and support-load tradeoffs, which are PM-owned, not purely engineering-owned.
• Vendor consolidation — if the org already pays for Google Cloud, this keeps abuse defense inside an existing contract and billing relationship rather than adding a fourth bot-management vendor.

When to Consider This Package

Consider it when all of the following hold:

1. You are on Laravel and have already decided Google reCAPTCHA Enterprise is the vendor. This package does not help you choose a vendor; it only reduces integration cost once that decision is made.
2. Your need is token assessment on specific server-side actions — not full bot management, not WAF, not device fingerprinting.
3. You have Google Cloud project setup capacity (Enterprise keys, project ID, service account / API credentials, IAM). That provisioning work dominates the integration effort and this package does not remove it.
4. You can absorb the maturity risk of a 1.0.0 release from a single organizational maintainer.

Look elsewhere — or stay in evaluation — when:

• Maturity signals are missing. The 1.0.0 release carries no substantive changelog, feature list, or migration notes; only a commit link. Before adoption, require evidence of: supported Laravel/PHP version matrix, automated test coverage, a security disclosure path, and recent commit activity. Absent that, treat this as a spike candidate, not a dependency.
• You need more than assessment. Cloud Armor, reCAPTCHA Enterprise's own fraud-defense features, or a dedicated bot-management vendor cover broader ground; a Laravel wrapper is a narrow slice.
• Data residency or vendor constraints apply. Assessment calls go to Google. If EU/regional processing or a self-hosted requirement is in play, this is likely disqualified early.
• You want a large maintained ecosystem. Compare against actively maintained community Laravel reCAPTCHA packages and Google's official client libraries before committing; a thin wrapper is easy to replace, but only if you wrap it behind your own interface.
• Your flow is high-volume on the critical path. Anything that adds a synchronous third-party call to checkout or login needs latency budget and a documented fail-open/fail-closed policy — verify the package makes that configurable before designing around it.

How to Pitch It (Stakeholders)

To executives: This is a small, low-cost integration that lets us put Google's risk scoring in front of our highest-abuse flows — signups, logins, and checkout — without adding a checkbox that hurts conversion for legitimate users. We already have (or are evaluating) the Google Cloud relationship, so this avoids a new vendor. The package itself is a convenience layer, not a strategic commitment; the strategic commitment is the vendor decision, which we should make deliberately. Recommend a timeboxed evaluation, not immediate production adoption.

To engineering: A Laravel-side wrapper for reCAPTCHA Enterprise assessment — config-driven credentials, a validation rule, and removal of hand-written HTTP/auth plumbing. Two asks before we depend on it: (1) confirm the supported Laravel/PHP matrix, test coverage, and maintenance activity, since the 1.0.0 notes are effectively empty; (2) integrate behind our own interface so the vendor and the wrapper are both swappable, and so we explicitly define timeout and fail-open/fail-closed behavior on the critical path.

Decision requested: Approval for a short evaluation spike against our login and signup flows, with a written recommendation on adopt / wrap-and-vendor / build in-house.