How To Integrate Google's reCaptcha Validation In Android

Introduction

How does it work?

1. We need to get the site key pair from SafetyNet by registering our app.
2. We will get Site Key and get user response token from SafetyNet server using SafetyNet API in Android.
3. Then, validate the token with the SafetyNet server using the curl commands and site key.

Registering your App with SafetyNet Server

1. Open the reCaptcha site from the following link.
   https://www.google.com/recaptcha/admin#list

2. Go to Register New Site section and select Option reCAPTCHA Android. The following figure explains the same.
   Figure 1

3. Then, add your Package Name in Package Names Section as shown in the above figure. We can add multiple apps and each can be separated by hitting Enter or new line.
4. Check or select the "Accept Terms" Checkbox and click the Register button. The following figure shows the same.
   
   Figure 2

5. Then, you will get the site key and secret key from SafetyNet API Server and it as well as shows client and server-side integration code snippets. The following figures show the same.
   
   Figure 3
   
   Figure 4

• Step 1: Creating a New Project with Android Studio
• Step 2: Setting up the library and AndroidManifest for the project.
• Step 3: Implementation of the SafetyNet API.
• Step 4: Captcha Response Token Validation.

1. Open Android Studio and select "Create New Project".
2. Name the project as you wish and select your activity template.
   
3. Click the “Finish” button to create a new project in Android Studio.

1. Add Google Play service library dependency in your app level build.gradle file. Here, I used the following dependency. You can change as per your Android SDK.
   1. implementation 'com.google.android.gms:play-services-safetynet:15.0.1'
   2. implementation 'com.android.volley:volley:1.1.0’
2. Then, click “Sync Now” to add the library.
3. Now, open your App Manifest file (AndroidManifest.xml) and add the following permission.
   1. <uses-permission android:name="android.permission.INTERNET" />

3. SafetyNet library is used to create the Captcha Validation in Android.

1. Add the following to get the Captcha Token from SafetyNet Server.
   1. SafetyNet.getClient(this).verifyWithRecaptcha(SITE_KEY)
   2. .addOnSuccessListener(this, new OnSuccessListener<SafetyNetApi.RecaptchaTokenResponse>() {
   3. @Override
   4. public void onSuccess(SafetyNetApi.RecaptchaTokenResponse response) {
   5. if (!response.getTokenResult().isEmpty()) {
   6. handleCaptchaResult(response.getTokenResult());
   7. }
   8. }
   9. })
   10. .addOnFailureListener(this, new OnFailureListener() {
   11. @Override
   12. public void onFailure(@NonNull Exception e) {
   13. if (e instanceof ApiException) {
   14. ApiException apiException = (ApiException) e;
   15. Log.d(TAG, "Error message: " +
   16. CommonStatusCodes.getStatusCodeString(apiException.getStatusCode()));
   17. } else {
   18. Log.d(TAG, "Unknown type of error: " + e.getMessage());
   19. }
   20. }
   21. });

2. Replace “SITE_KEY” with your appropriate “Site Key” get from SafetyNet API while registering app.
3. The API will check the Server and it has a separate callback from success and failure.
4. At Success, we will get Captcha Response Token which will be used to validate the user interaction is made by a bot or real human.
5. We will discuss how to validate the token with SafetyNet API Server in the next step.

1. We have to verify the token getting from the server using the secret key.
2. It can achieve by using the following.

• API Link - https://www.google.com/recaptcha/api/siteverify
• Method - POST
• Params – secret, response (We have to pass the “SECRET_KEY” and “TOKEN” respectively)