title: Google's Recaptcha V3 - should I track the score, or suffice with the "success" being true?
body: <p>Background: my website is pretty simple, containing a main page with a list of links (provided by 3rd party service) - each links pops up a file upload input with a submit button. In that popup I embedded the Recaptcha script, and verified the token upon file submission. Because of this multiple popup setup I chose V3 for zero user interactions with the verification mechanism.</p>
  
  <p>Now, a question arise - how should I interpret Google's response from google.</p>
  
  <p>Google documentation for V3 says:</p>
  
  <blockquote>
    <p>reCAPTCHA learns by seeing real traffic on your site. For this reason,
    scores in a staging environment or soon after implementing may differ
    from production. As reCAPTCHA v3 doesn't ever interrupt the user flow,
    you can first run reCAPTCHA without taking action and then decide on
    thresholds by looking at your traffic in the admin console. <strong>By
    default, you can use a threshold of 0.5.</strong></p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/QQNm5.png" rel="noreferrer"><img src="https://i.stack.imgur.com/QQNm5.png" alt=""></a></p>
  
  <p>It is pretty clear to me, from this description, that the <code>score</code> is what matters - 0.0 for most likely bot, 1.0 for most likely human. So in my code, I check that <code>success == true</code> and <code>score &gt;= 0.5</code></p>
  
  <p>However - <strong>none</strong> of the V3 examples I find online for server side validation pay any attention to the score. here are 3 of them. All three only check for the request being successful:</p>
  
  <p><a href="https://stackoverflow.com/a/54118106/3367818">https://stackoverflow.com/a/54118106/3367818</a></p>
  
  <p><a href="https://stackoverflow.com/a/52633797/3367818">https://stackoverflow.com/a/52633797/3367818</a></p>
  
  <p><a href="https://dzone.com/articles/adding-google-recaptcha-v3-to-your-laravel-app" rel="noreferrer">https://dzone.com/articles/adding-google-recaptcha-v3-to-your-laravel-app</a></p>
  
  <p>Finally, my question is - is that a misconception of V3's mechanism, or is it me missing something?</p>
  
  <p>Thanks.</p>