How to Allowlist testRigor IP Addresses in Google reCAPTCHA

Fedor Biriukov

This guide shows how to set up an IP address allowlist in Google reCAPTCHA (part of Google Cloud Fraud Defense) so testRigor can test pages protected by reCAPTCHA without getting blocked.

Important: This guide applies only if your application uses Google reCAPTCHA keys that you manage in your own Google Cloud project. If your site uses a different CAPTCHA provider, check that provider’s documentation for how to allowlist IP addresses.

Use Case

reCAPTCHA is built to tell people apart from bots. Automated test traffic, including traffic from testRigor, can be flagged as suspicious. When that happens, tests may get low risk scores, get stuck on challenges, or fail at the login, sign-up, or checkout steps.

• An application protected by Google reCAPTCHA
• A test suite configured in testRigor
• Tests failing or getting blocked because of reCAPTCHA

then you can add testRigor’s IP addresses to your reCAPTCHA key’s allowlist. For requests from an allowlisted IP address or subnet, reCAPTCHA skips verification and always returns a score of 0.9, so your tests can go through the protected flows as expected.

Note: The allowlist applies to all traffic coming from these IP addresses. We recommend using it on test and staging keys whenever possible, and allowlisting production keys only when you really need to.

Before You Begin

1. testRigor IP addresses and subnets to allowlist. Contact testRigor support to get the current list.
2. Your reCAPTCHA key (site key) that your application uses.
3. Your Google Cloud Project ID.
4. The reCAPTCHA Enterprise Admin role (roles/recaptchaenterprise.admin) in that Google Cloud project.
5. The Google Cloud CLI (gcloud) installed and authenticated, or another way to call the REST API.

Limitation: Each allowlist can hold up to 1,000 IP addresses and subnets.

Step 1: Add testRigor IP Addresses to the Allowlist

You can add IP addresses with the gcloud CLI or the REST API. Repeat this step for each testRigor IP address or subnet.

Option A: Using gcloud CLI

• KEY with your reCAPTCHA key
• IP_ADDRESS_OR_SUBNET with a testRigor IP address or subnet provided by testRigor support

gcloud recaptcha keys add-ip-override KEY \
--ip=IP_ADDRESS_OR_SUBNET \
--override=ALLOW

Option B: Using REST API

POST https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/keys/KEY:addIpOverride

{
  "ip_override_data": {
    "ip": "IP_ADDRESS_OR_SUBNET",
    "override_type": "ALLOW"
  }
}

Changes usually take effect within a few minutes.

Step 2: Verify the Allowlist

To see all IP addresses currently on the allowlist for your key:

Option A: Using gcloud CLI

gcloud recaptcha keys list-ip-overrides KEY --format=json

Option B: Using REST API

GET https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/keys/KEY:listIpOverrides

{
  "ipOverrides": [
    {
      "ip": "IP_ADDRESS_OR_SUBNET",
      "overrideType": "ALLOW"
    }
  ],
  "nextPageToken": ""
}

Check that every testRigor IP address and subnet you added appears in the list.

Step 3: Run Your testRigor Tests

1. Open your test suite in testRigor.
2. Run a test that goes through a reCAPTCHA-protected page, such as login, sign-up, or a contact form.
3. Confirm that the test gets past the reCAPTCHA step without being blocked.

If you have access to your reCAPTCHA assessment results, you can also check that assessments for these requests return a riskAnalysis.score of 0.9.

Important: The allowlist checks the actual source IP address of the traffic that generated the reCAPTCHA token. It does not use the event.userIpAddress field that your backend sends in the assessment. That means the allowlist only works if the browser traffic really comes from testRigor’s IP addresses. If you route testRigor traffic through a tunnel, proxy, or VPN, allowlist the public exit IP of that connection instead.

If you still have issues, contact testRigor support and we’ll help you get your tests running.