google ReCaptcha v2: What constitutes a server-side integration?

Question

I want to implement google's recaptcha v2 on a sign up form for my app. I have read in a lot of places that "client-side" verification isn't enough, and that you should implement it on the server side as well because of bots possibly being able to force false positive responses, etc.

Now in google's recaptcha documentation it says you need to perform a POST Request for "server-side verification" (and to be the most secure in terms of verifying the captcha response value). If I make this POST Request in client-side javascript to google's servers, does that suffice as secure? Or does my post request NEED to happen on server-side code such as express?

Answer 1

The POST request needs your secret / private key as a parameter. You should not publish your secret / private key. Which you would when you send the POST via JavaScript.