As an option to increase org security, Okta supports CAPTCHA to prevent automated sign-in attempts. It is possible to integrate either of two services: hCaptcha or reCAPTCHA v2. This knowledge article presents the differences between hCaptcha and reCAPTCHA v2.
- Okta Identity Engine (OIE)
- CAPTCHA integration
NOTE: The vendor implementations supported by Okta are both invisible. For reCAPTCHA v2, select the Invisible reCAPTCHA badge. Please refer to the CAPTCHA integration document for more information.
When selecting either of the two options in Okta CAPTCHA integration, verify the Secret/Sitekey corresponds as described hCAPTCHA(for example, Google hcaptcha) - hCAPTCHA(OKTA hcaptcha) and reCAPTCHA v2(I'm not a robot / Invisible) - reCAPTCHA v2(OKTA).
- When using hCAPTCHA, the Sitekey and Secret will be configured here.
Using the provided Sitekey and Secret in our Okta implementation does not have additional setup factors, and depending on the Options selected (Sign-in/Sign-up or Password reset) the user will always be prompted by the CAPTCHA.
- When using reCAPTCHA v2, there will be additional selections such as an "I'm not a robot " Checkbox and an Invisible reCAPTCHA badge.
NOTE: When using Invisible reCAPTCHA v2, there may be no prompt for the CAPTCHA on the computer as this advanced system scans for the previous activity, among other things, and decides if this is necessary or not, making this expected behavior.
NOTE: CAPTCHA is not supported for Password Reset in identifier-first authentication flows. That is when users enter passwords on a second sign-in page. To work around this, the authentication flow can be changed so that users see the username and the password on the same page in the Sign-In Widget: Ensure that the org does not use any Identity Providers for authentication. Use the Okta option for AND Identity provider is in the Global Session Policy rules, but not the Specific IdP option. Ensure all of the Global Session Policy rules have the Establish the user session with the option set to "A password".
