How to create users via API while captcha is enabled?

Product Support

AI-generated summary

putty reports that enabling reCAPTCHA (v2) blocks their n8n workflow for creating users via the API. Posting to /users.json with an admin API key returns "Captcha verification failed", even with active or approved parameters, while the same request succeeds when captcha is disabled. The user notes that the captcha check appears to require a token generated by the browser signup form, with no apparent exemption for API requests. Additionally, POST /admin/users returns a 404 error, suggesting it is not a viable alternative, although the API key works for other admin endpoints. Since the request is rejected by Discourse before contacting Google, adjusting reCAPTCHA console settings does not help.

The post concludes by asking if there is a supported method for API user creation with captcha enabled. If not, putty suggests a feature request to allow admin API requests to skip captcha verification, which would resolve the conflict between bot prevention measures and legitimate administrative automation.

1

After hundreds of bot accounts being created, I’m tinkering with reCAPTCHA (v2). The problem is that one of my n8n workflows that creates users is now being blocked.

When I POST /users.json with an admin API key returns {"success":false,"message":"Captcha verification failed"}.

What I’ve found:

  • It fails with or without active/approved in the request, so it isn’t the activation parameters. With the captcha off, the same request succeeds.
  • The captcha check seems to need a token that only comes from the browser signup form, and I don’t see an exemption for API requests.
  • POST /admin/users isn’t an alternative. It returns 404 even with a valid admin key. The same key returns 200 on GET /admin/users/list/active.json, so the key is fine.
  • The reCAPTCHA settings in Google’s console don’t help, since the request is rejected before Discourse contacts Google. I don’t expect reCAPTCHA v3 or hCaptcha to help either, since the missing-token check seems to run first.

Is there a supported way to create users through the API while the captcha is on? If not, would an “admin API requests skip the captcha” option make sense as a feature request?