drf-recaptcha

What it is and what it does

drf-recaptcha is a field serializer for Django REST Framework that embeds Google's reCAPTCHA verification into your API request validation pipeline. It supports both reCAPTCHA v2 (checkbox) and v3 (invisible, score-based) flows, allowing you to reject bot traffic at the serializer level before your business logic runs.

The package wraps Google's verification API and exposes ReCaptchaV2Field and ReCaptchaV3Field as field types. You add them to your serializers, configure a secret key in Django settings, and the field automatically validates incoming tokens against Google's servers. For v3, you can set per-action score thresholds to tune sensitivity. It supports dynamic secret key injection via request context, useful for multi-tenant or platform-specific deployments.

Use it for:

• Protect user registration or password-reset endpoints from automated account-creation attacks using reCAPTCHA v2.
• Add invisible bot detection to feedback or contact forms by validating reCAPTCHA v3 scores without user friction.
• Enforce action-specific bot thresholds using v3 action scores configured in settings.
• Test bot-detection logic in CI/CD by toggling DRF_RECAPTCHA_TESTING mode to mock verification without calling Google.
• Override secret keys per request via serializer context for multi-platform deployments.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds reCAPTCHA v2 and v3 field validation to Django REST Framework serializers, integrating Google's bot-detection service into API endpoints.

Yes, if you are running Django and djangorestframework and need reCAPTCHA integration. The package is stable, supports current Python versions (3.10, 3.11, 3.12, 3.13) and recent Django releases (4.2, 5.0, 5.1, 5.2), has low install friction, and carries no known vulnerabilities. The aging maintenance status is a minor concern for a mature, narrow-scope library; monitor the repository for security updates. Not necessary if you handle reCAPTCHA verification outside the serializer layer.

Install

drf-recaptcha on PyPI

pip install drf-recaptcha

uv add drf-recaptcha

poetry add drf-recaptcha

Installing drf-recaptcha

Before you install

Low install friction with a pure-Python wheel. Maintenance status is aging—last release was 357 days ago—but the repository remains active with recent commits and the package is marked Production/Stable. Supports current Python versions and recent Django releases.

License in practice

MIT license is permissive, allowing commercial and private use with minimal restrictions. No notable licensing constraints for typical adoption.

Quickstart

pip install drf-recaptcha

# In Django settings:
INSTALLED_APPS = [..., "drf_recaptcha"]
DRF_RECAPTCHA_SECRET_KEY = "YOUR_GOOGLE_SECRET"

# In a serializer:
from drf_recaptcha.fields import ReCaptchaV2Field

class MySerializer:
    recaptcha = ReCaptchaV2Field()

Requires a Google reCAPTCHA account and secret key. The request context must be passed to the serializer for verification to work.

Verify before relying

• Whether the package handles rate-limiting or request throttling when verifying with Google's API.
• Performance impact of network calls to Google's verification endpoint during serializer validation.
• Behavior and error handling when Google's reCAPTCHA service is temporarily unavailable.
• How django-ipware is used internally for client IP detection.

Package facts

Evidence: drf_recaptcha-4.0.3-py3-none-any.whl

Keywords: django, drf, rest, django-rest-framework, reCAPTCHA, reCAPTCHA v2, reCAPTCHA v3

Tags

More Libraries packages