Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

captcha_failed

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The request carried no captcha solution, or one that is wrong, expired or used (400).

Meaning

Registration, every request for an emailed link (password reset, a new verification link), and sign-in after auth.captcha.sign_in_after recent failures for the address or the IP, need a solved captcha from GET /v1/auth/captcha. Each solution is single use and expires after auth.captcha.altcha.validity (default 5m) with the built-in provider.

Impact

The user is asked to solve a new challenge. Occasional failures are expected: a page left open past the validity, or a double submit. Every user failing means the page and the server disagree about the provider or its keys.

Diagnosis

  1. Look the request id up on the Troubleshooting page. The refusal is recorded on the action it guarded (for example auth.sign_in.completed) with reason access_denied and cause captcha_missing, captcha_invalid, captcha_expired or captcha_replayed.
  2. All captcha_invalid with a hosted provider: check auth.captcha.provider, auth.captcha.site_key and auth.captcha.secret belong to the same site.

Mitigation

  • As a user: solve the new challenge and submit once.
  • As an operator: match the provider keys; raise auth.captcha.altcha.validity if users take longer than it allows.

Escalation

Escalate when solved captchas are refused for everyone with a correct configuration. Open an issue with request ids, the audit causes, the provider and the server version. Never attach the captcha secret.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.