How to use Google ReCaptcha as "security"

Hi,

I have a path and have to secure it with either an API key or for browser clients with Google ReCaptcha, where the client recaptcha token is used within the request payload.

Payload

{
  "g-recaptcha-response": "recaptcha client token which has to be verified",
  // other payload data
}

OpenAPI YAML

openapi: 3.0.0

info:
  title: Test
  description: API
  version: 1.0.0

components:
  securitySchemes:
    ApiKey:
      type: apiKey
      name: X-Api-Key
      in: header

paths:
  /a/b/c:
    post:
      description: ABC
      security:
        - ApiKey: []
        - GoogleRecaptcha: [] # <--- how?!
      responses:
        "200":
          description: success
          content:
            application/json:
              example:
                status: ok

How do I define the security scheme for GoogleRecaptcha?

Start with the OpenAPI 3.0 securitySchemes and the /a/b/c example shown in the issue. Check how the specification models token-based security and whether the g-recaptcha-response payload can be represented; done means providing a clear, specification-aligned explanation or example for this use case.