---
title: "Captcha Config"
method: GET
path: "/api/v1/auth/captcha-config"
tags: ["auth"]
---

# Captcha Config

`GET /api/v1/auth/captcha-config`

Return whether the caller should use captcha test keys.

The FE calls this on page load (fire-and-forget).  If the caller's IP
is in CAPTCHA_TEST_MODE_IPS the widget will use the always-pass test
site key and the BE will validate against the corresponding test secret.

Non-whitelisted callers receive ``use_test_captcha: false`` and the normal
prod key pair is used — captcha remains fully enforced for all users.

## Headers

- `X-Forwarded-For` string, nullable

## Response `200`

Successful Response

- CaptchaConfigResponse — Response for /api/v1/auth/captcha-config. use_test_captcha: when True the FE should render the captcha *test* site key (always-pass) and the BE will validate against the test secret key. No site key is included in the response — both sides derive the correct key from their own env vars.
  - `use_test_captcha` boolean, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/spotdraft/apis/oogway-be-router.md) · [All operations](https://skmtc.net/spotdraft/apis/oogway-be-router/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/spotdraft/oogway-be-router/revisions/738a4b0ef47e/schema)