Enable reCAPTCHA on the public booking form
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Reduce automated submissions by activating the module's reCAPTCHA check with the CRM's configured Google keys.
What you’ll accomplish
Reduce automated submissions by activating the module's reCAPTCHA check with the CRM's configured Google keys. It uses Pixie CRM's permission-aware appointment, availability, status and integration flow rather than an unconnected diary entry.
How it works
The public view renders reCAPTCHA only when the module option is enabled and the CRM has valid site and secret keys.
The public controller verifies the submitted token before creating an appointment.
Missing or invalid keys can block legitimate bookings or leave the challenge absent.
Follow these steps
- Configure the CRM reCAPTCHA site and secret keys.
- Enable reCAPTCHA in Appointments booking settings.
- Save.
- Go to the form signed out and complete the challenge.
- Test rejection with an incomplete or invalid challenge.
Settings to check
Check it worked
After this workflow completes, Pixie CRM keeps the appointment and its supported relationships connected. Reopen the appointment and verify the saved status, date, timezone, customer or lead, service, provider, attendees, reminder state, calendar or meeting reference, invoice reference and history that apply to this feature. External email, SMS, Google, Microsoft or payment outcomes must be checked separately from the Pixie CRM database save.
- Open the saved appointment and confirm the final status and source.
- Check the participant, provider, timing and timezone from the full detail page.
- Review the relevant table filter, calendar, history, report or linked invoice instead of relying only on a success message.
Common mistakes to avoid
- Never expose the secret key in documentation or page source.
- Use keys authorised for the live domain.
- Test after changing domains or subdomains.
- Use the least destructive correction and retain the appointment history when the booking existed operationally.
- Never bypass a permission, availability, approval, client-access or verification control by changing an unrelated route or setting.
