# Captcha

Allegro's sign-in is passwordless, so there is no password for an attacker to guess. The thing worth protecting is different: every sign-in request creates an audience member if one does not exist and sends an email. A script rotating through addresses can fill your audience with junk records and bill you for the mail, and heavy bounce or complaint rates from those sends put email delivery at risk for everyone on the sending domain.

Turning on captcha makes each sign-in attempt prove it came from a person before any of that happens.

**Organization Settings › Access & Identity › Captcha** is where you switch it on. It is off until you configure it, and an organization that never visits this screen behaves exactly as it always has.

## What readers see[​](#what-readers-see "Direct link to What readers see")

Nothing. Google reCAPTCHA v3 scores each attempt in the background rather than showing a puzzle or a checkbox. Google does add a small badge to the corner of pages where the login form appears; its terms require you either to leave that badge in place or to display a short attribution line near your sign-in button instead.

## Setting it up[​](#setting-it-up "Direct link to Setting it up")

You bring your own reCAPTCHA keys rather than using a shared Allegro account. That is deliberate: reCAPTCHA's free tier is capped per Google account across every site using it, so a shared key would run out for everyone at once.

1. In the [reCAPTCHA admin console](https://www.google.com/recaptcha/admin), create a key of type **reCAPTCHA v3**.
2. Register every domain your login form appears on. A domain you forget will fail verification for readers on that domain.
3. Copy the **Site key** and **Secret key** into the Captcha settings screen.
4. Set **Provider** to Google reCAPTCHA v3 and save.

The secret key is encrypted and never sent to a browser. The site key is public by design — it appears in the page source, which is normal and safe.

## Choosing a minimum score[​](#choosing-a-minimum-score "Direct link to Choosing a minimum score")

reCAPTCHA returns a score from 0.0 to 1.0, where lower means more bot-like. The **Minimum score** slider sets the point below which a sign-in attempt is rejected.

| Score | Meaning                                                  |
| ----- | -------------------------------------------------------- |
| 0.0   | Almost certainly automated.                              |
| 0.5   | Google's suggested starting point, and the default here. |
| 1.0   | Almost certainly a person.                               |

Raise it only after watching real traffic. This is a genuine trade-off rather than a dial that goes from "less safe" to "more safe": every legitimate reader who scores below your threshold is turned away, sees only a generic error, and has no way to prove otherwise. A threshold that is too high looks to you like a quiet drop in sign-ups, not like an error.

## When Google is unreachable[​](#when-google-is-unreachable "Direct link to When Google is unreachable")

If reCAPTCHA cannot be reached, or your credentials are rejected, sign-in requests are allowed through and the failure is logged. A Google outage or a mistyped secret key must never lock readers out of your site, and during one you are back to the protection you had before turning captcha on.

A reader whose browser blocks Google's script — an ad blocker, a privacy extension, or a strict corporate network — is a different case. That attempt is rejected, because a sign-in that can simply decline to be checked would make the whole feature pointless. This is the main cost of switching captcha on, and it is worth weighing against how much automated traffic you are actually seeing.

## Properties[​](#properties "Direct link to Properties")

A property can use the organization's setup, supply its own key pair, or turn captcha off for itself. Credentials are all-or-nothing per property: a property either provides every field or inherits every field, so its site key can never be paired with the organization's secret.

One thing to watch: a property-level selection covers that property's domains only. If the organization itself has no provider selected, sign-in requests to your main Allegro domain stay unprotected even while a property is covered. Select a provider at the organization level to cover everything.

## Turning it off[​](#turning-it-off "Direct link to Turning it off")

Set **Provider** to Off. Your keys stay saved, so switching back on later does not mean fetching them from Google again.