Skip to main content

Overcoming Captcha Issues

Thunders testing agent allows teams to run end-to-end, automated tests across your website just like a user would.

Ines avatar
Written by Ines
Updated over a month ago

Problem: CAPTCHAs (Cloudflare Turnstile, Google reCAPTCHA, etc.) are designed to stop bots. They therefore also prevent automated end-to-end tests.

To let Thunders scan, explore and validate flows like a human would, customers must temporarily allow test traffic to bypass CAPTCHA on non-production surfaces.

To unlock the value of AI-powered testing, we recommend disabling CAPTCHA on test environments following the best practices below.

1) Disable CAPTCHA in non-production environments

  • Turn off the CAPTCHA enforcement in QA/staging via environment config or a feature flag. Typical places to change it: environment variables, config files, or toggles in admin/console. This is common and simple if the app separates environments.

How to implement (example):

  • CAPTCHA_ENABLED=true in production; CAPTCHA_ENABLED=false in staging.

  • Deploy; run Thunders against the staging domain.

Risk & mitigation: Make sure staging is not exposed to public traffic (use IP allowlists, auth, VPN). Document the change and revert after testing.

2) Whitelist Thunders’ test IPs / clusters

  • You can add one of Thunders cluster IP(s) to your CAPTCHA provider / firewall allowlist so requests from those IPs bypass CAPTCHA.

How to implement (example):

  • Client: add Thunders public test IP(s) (we will provide these) to the CAPTCHA provider’s allowlist or to firewall WAF rules as “trusted” for staging.

  • Note: IP whitelisting is best for staging and internal test networks.

3) Use provider test keys or dedicated test mode (best for dev/staging)

  • Most providers provide testing keys or testing modes so captcha responses always pass in test environments.

  • Example: Google reCAPTCHA provides official test keys for v2/v3 that always pass; Cloudflare Turnstile provides testing sitekeys/dummy keys and a Turnstile testing flow. Use those keys in staging. Google for Developers+1

How to implement (example):

  • Create separate site keys / secret keys for staging and production.

  • In staging config / env: set RECAPTCHA_SITE_KEY=test_key, RECAPTCHA_SECRET_KEY=test_secret (or the equivalent Turnstile test sitekey/secret).

  • Point Thunders to the staging URL.

Why: fast, provider-supported, audit-friendly, safe if keys are scoped to test env.

4) Exempt dedicated test accounts (trusted accounts)

  • Mark one or more user accounts as trusted so the app doesn’t present CAPTCHA for those logins (e.g., accounts with a bypass_captcha=true flag).

  • Create accounts like [email protected] and run all Thunders flows through those credentials.

How to implement (example):

  • Add a skip_captcha boolean on user profiles (or make the app check a trusted role before presenting captcha).

  • Ensure test accounts have least privilege and rotate credentials regularly.

Best Practice

  • Always limit access bypass to test/staging/QA environments, NEVER on production.

  • Document which method was used for traceability

Did this answer your question?