We have successfully integrated Google reCAPTCHA Enterprise into our site, and it functions perfectly when I fill out and submit the form. However, our logs reveal numerous error messages indicating that requests are missing the required non-empty reCAPTCHA token parameter.

Upon investigation, it appears that many of these errors are likely due to bot-like behavior, as we observe that the form is often submitted within just 1-2 seconds after the page is loaded. However, we also encounter cases where the issue does not seem to stem from automated scripts. In these instances, the form submission occurs after a reasonable period, suggesting that the issue might not be solely related to rapid submissions.

We have implemented Google reCAPTCHA Enterprise on our site by including the following script in the section of our HTML:

<script src="https://www.google.com/recaptcha/enterprise.js?render=SITE_KEY"></script>

On the frontend, we use a submitForm function to retrieve the reCAPTCHA token and submit the form data to our backend. The submitForm function is defined as follows:

function submitForm(form, url, siteKey) {
    // Display a loading spinner or similar indicator
    grecaptcha.enterprise.ready(async () => {
        const token = await grecaptcha.enterprise.execute(siteKey, { action: 'submit' });
        
        // Perform additional processing for complex inputs
        const searchParams = new URLSearchParams();
        searchParams.append('g-recaptcha-response', token);
        
        // Submit the form data via a POST request
        fetch(url, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: searchParams.toString(),
        })
        .then((response) => {
            // Handle the response from the server
            ...
        });

In this implementation, the fetch request is only executed after grecaptcha.enterprise.ready and await grecaptcha.enterprise.execute. Therefore, the token should be obtained before the POST request is made. However, if the token is empty, it could be due to Google returning an empty value or if the request is being sent manually, bypassing this JavaScript code.

My question is: Can grecaptcha.enterprise.execute return empty or null values?
If so, in which cases tokens can be empty? How should we correctly handle it? Is it safe to check the token in FE side before sending a POST request?
If not, is it something with our implementation? Why might it work in some cases but not in others?

I reviewed Google’s documentation on reCAPTCHA but couldn’t find relevant information about my question. Additionally, I checked the reCAPTCHA logs for incoming token requests, but it seems that only assessment requests are being logged.