Your CAPTCHA secret is a flag your desktop client can't see
Setting a Turnstile or reCAPTCHA secret made our signup API require a token our desktop client never sends. How to find the same 403 in your stack first.
/8 min read / securitywebdevapidebugging