reCAPTCHA in Android

SafetyNet reCAPTCHA API

The SafetyNet service incorporates a reCAPTCHA API that you can use to shield your application from malicious efects. 

reCAPTCHA is a free service that uses an advanced risk investigation engine to shield your application from spam and other harsh activities. On the off chance that the administration speculates that the client communicating with your application may be a bot rather than a human, it serves a CAPTCHA that a human must unravel before your application can keep executing.

Register a reCAPTCHA key pair

To enroll a key combine for use with the SafetyNet reCAPTCHA API, explore to the reCAPTCHA Android information exchange site, at that point finish the accompanying arrangement of steps: 

In the frame that shows up, give the accompanying data: 

Label: An interesting name for your key. Normally, you utilize the name of your organization or association. 

Package Names: Provide the bundle name of each application that uses this API key. All together for an application to utilize the API, the bundle name that you enter must be a correct match of the bundle name for that application. Enter each bundle name alone line. 

Send alerts to owners: Check this checkbox on the off chance that you need to get messages about the reCAPTCHA API. 

Check the Accept the reCAPTCHA Terms of Service checkbox, at that point click Register. 

In the Adding reCAPTCHA to your application segment on the page that shows up straightaway, your open and private keys show up under Site key and Secret key, individually. You utilize the site key when you send the confirm demand, and you utilize the mystery key when you approve the client response token.

Add SafetyNet API dependency

Before utilizing the reCAPTCHA API, you have to add the SafetyNet API to your prject. In the event that you utilize Android Studio and you need to specifically aggregate this API into your Gradle conditions, you ought to incorporate the assemble decide that is appeared in the accompanying code snippet:

apply plugin: 'com.android.application'
...
dependencies {
    compile 'com.google.android.gms:play-services-safetynet:15.0.1'
}

reCAPTCHA API Usage

This area depicts how to call the reCAPTCHA API to send a CAPTCHA confirmation ask for and get the client response token.

Send Verify Request

To invoke the SafetyNet reCAPTCHA API, you call the verifyWithRecaptcha() technique. Ordinarily, this method compares to the client's choosing a UI component, for example, a button, in your activity/fragment.

SafetyNet.getClient(getContext()).verifyWithRecaptcha(getContext().getString(YOUR_API_SITE_KEY))

                    .addOnSuccessListener((AppCompatActivity) getContext(), new OnSuccessListener() {
                        @Override
                        public void onSuccess(SafetyNetApi.RecaptchaTokenResponse recaptchaTokenResponse) {
                            if (!recaptchaTokenResponse.getTokenResult().isEmpty()) {
                                reCaptchaSiteVerify(recaptchaTokenResponse.getTokenResult());  // call site verify api
                            }

                        }
                    }).addOnFailureListener((AppCompatActivity) getContext(), new OnFailureListener() {
                @Override
                public void onFailure(@NonNull Exception e) {
                    if (e instanceof ApiException) {
                        ApiException apiException = (ApiException) e;
                        int statusCode = apiException.getStatusCode();
                    } else {
                        // A different, unknown type of error occurred.
                            Log.e(TAG, "Error: " + e.getMessage());
                    }
                    Log.e(TAG, "Error: " + e.getMessage());
                }
            });
 

Validate user response token

At the point when the reCAPTCHA API executes the onSuccess() strategy, the client has effectively finished the CAPTCHA challenge. In any case, this technique just shows that the client has unraveled the CAPTCHA effectively. Despite everything you have to approve the client's response token from your backend server.