Google reCAPTCHA as a captcha provider, in either of its two kinds — a key is made for one of them in Google's admin console:

• v2 ("v2") — the "I'm not a robot" box, drawn above the form's button;
• v3 ("v3") — nothing to click: Google scores the visitor from 0 to 1 as the form is sent, and a score under security.captcha.recaptcha.min_score (out of 100) is refused. Google's badge shows in a corner of the page.

Each scope keeps its own site key, secret key, kind and lowest score. A token is good for two minutes and one check; a v3 token must also name the form it was asked for.

Google's published v2 test keys (site key 6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI, secret 6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe) pass every check on any address (test?: true), so their answer is not held to the site's address, nor remembered as used. v3 has none: test it with a key of its own that lists localhost.