reCaptcha with Custom URLs

[Max S_]

Hey Community

I've been facing some issues with using Custom URLs in combination with Google's reCaptcha. It seems to me like the default site_key (google.captcha.site_key) and secret (google.captcha.secret) do are not registered / maintained to the Custom URLs that you can set up on an instance.

I am using a customized Record Producer Widget in my GSP portal to include the reCaptcha at the bottom of the form to validate the submit. The issue that I am seeing is that when i access any Record Producer via the Custom URL, the reCaptcha Widget always displays the error:

ERROR for site owner: Invalid domain for site key

It seems to me like this is an issue on the Google reCaptcha key registration side. I presume that ServiceNow (somewhat understandably) does not update the registered domains on the Google registration side with the Custom URLs that you maintain on the platform.

To confirm this I created my own reCaptcha registration and added the main instance domain and the Custom URLs domain. I switched the two system properties (mentioned above) to the new key and that seems to work.

My question in conclusion is:

1. Is there a way of maintaining the domains on Google's reCaptcha registration of the OOB key?
2. Do you have any other ideas as to how to manage this?
3. Do you think that a customer is supposed to be maintining their own reCaptcha key instead of using the OOB one?

[Robb Perk]

ServiceNow does not automatically register Custom URL domains in Google's reCaptcha configuration for the out-of-the-box key—that's a Google-side registration, not something ServiceNow maintains. Your troubleshooting was correct: the OOB key only works with the main instance domain. The practical solution is to create your own reCaptcha key, register both the main instance domain and each Custom URL domain in Google's reCaptcha console, then update the two system properties (google.captcha.site_key and google.captcha.secret) to point to your custom key. This gives you full control over which domains are authorized. Using your own key instead of the OOB one is the supported approach when Custom URLs are involved.