Managing Credentials with Environment Variables

Googles reCAPTCHA

Sign up for your own API keys

1. Manage your reCAPTCHA API keys
2. Enter your own label
3. Choose reCAPTCHA v2
4. Enter your domain (Dev and/or Production)
   For workspaces, the domain is: treehouse-app.com
5. Accept the reCAPTCHA Terms of Service. 6 Finish by pushing the Register button

You will be given a "Site Key" and a "Secret Key". You will be able to go back and grab these credentials at any time.

Add the Site Key and Secret Key to your Environment Variables

FOR SECURITY PURPOSES, the only variable you need to secure is the secret key. The site key will be visible in the source code of your site.

SITE_KEY=your_site_key_value
SECRET_KEY=your_secret_key_value

Set up the form

1. In the html header of the file which includes the form, you must link to the JavaScript for the reCAPTCHA

   
   <script src='https://www.google.com/recaptcha/api.js' ></script>
   

2. Between the opening and closing form tags, add the following div

   
   <div class="g-recaptcha form-label-group" data-sitekey="<?php echo getenv('SITE_KEY'); ?>"></div>
   

Process the form

To check if the reCAPTCHA has be completed, send a request to the Google reCAPTCHA servers along with your Secret Key and the form response.

$captcha = json_decode(
  file_get_contents(
    'https://www.google.com/recaptcha/api/siteverify?secret='
    .getenv('SECRET_KEY')
    .'&response='.$_POST['g-recaptcha-response']
    )
);
if ($captcha->success == false) {
  //return and error and do not process the form
}