Testlie
Menu

API mocks

On this page

Bot protection (CAPTCHA)

Test what your backend does with the answer to a CAPTCHA check: a pass, a score that looks like a bot, a token made for another action, an expired or replayed token. Create reCAPTCHA Enterprise or Cloudflare Turnstile under Systems → Identity → Bot protection.

Testlie is independent of Google and Cloudflare. The names identify compatibility, not affiliation or certification.

Only the server-side half is mocked: the call your backend makes to check a token. Your pages keep loading the real reCAPTCHA or Turnstile script, which still hands out tokens. Google issues reCAPTCHA tokens on localhost when the site key allows it; for Turnstile, use one of Cloudflare's test site keys. The mock does not read those tokens: it decides the answer.

What decides the answer

  1. A test token decides that call. Send it in place of the browser's token, from a test or an API client:

    Token reCAPTCHA Enterprise Turnstile
    testlie-pass valid, score 0.9 success: true
    testlie-low-score valid, score 0.0, reason AUTOMATION invalid-input-response
    testlie-score-0.3 valid, score 0.3 (any score from 0 to 1, two decimals) below 0.5 fails as above
    testlie-action-<name> valid, tokenProperties.action is <name> action is <name>
    testlie-expired valid: false, EXPIRED timeout-or-duplicate
    testlie-dupe valid: false, DUPE timeout-or-duplicate
    testlie-malformed valid: false, MALFORMED invalid-input-response
    testlie-browser-error valid: false, BROWSER_ERROR invalid-input-response
    testlie-site-mismatch valid: false, SITE_MISMATCH invalid-input-response

    Test tokens can be used any number of times.

  2. The mock's scenario, for every other token: set the outcome to Decline and pick what goes wrong (low score, another action, expired, already used...). Leave it on Auto and tokens pass.

  3. Replays: any other token passes once. Checking it again answers DUPE (reCAPTCHA) or timeout-or-duplicate (Turnstile), as the real services do. A Turnstile retry with the same idempotency_key gets the first answer again.

The usual API failure scenarios and Next time rules (500, 429, timeout...) work here too, for testing what your login does when the check itself fails.

reCAPTCHA Enterprise

Replace https://recaptchaenterprise.googleapis.com with your system's base URL and use its API key and project ID:

POST <base URL>/v1/projects/<projectId>/assessments?key=<apiKey>
{ "event": { "token": "...", "siteKey": "...", "expectedAction": "login" } }

The answer has Google's shape: tokenProperties (valid, invalidReason, action, hostname, createTime), riskAnalysis (score, reasons) and the event you sent. A passing token's action is your expectedAction, so compare them as you would in production. Any site key is accepted. POST .../assessments/<id>:annotate answers {}. A wrong API key answers 400 INVALID_ARGUMENT, another project 403 PERMISSION_DENIED. Not simulated: account defender, fraud prevention, password leak checks, WAF and mobile key types.

Cloudflare Turnstile

Replace https://challenges.cloudflare.com with your system's base URL and use its secret key:

POST <base URL>/turnstile/v0/siteverify
secret=<secretKey>&response=<token>

Form-encoded or JSON, with optional remoteip and idempotency_key. Answers have Cloudflare's shape: success, error-codes, challenge_ts, hostname, action, cdata. A missing or wrong secret answers missing-input-secret or invalid-input-secret. Not simulated: remoteip checks, cdata round trips and ephemeral IDs that mean anything.