diff --git a/packages/api/src/routers/auth/auth_router.ts b/packages/api/src/routers/auth/auth_router.ts
index ec18ffcbb..76f16a122 100644
--- a/packages/api/src/routers/auth/auth_router.ts
+++ b/packages/api/src/routers/auth/auth_router.ts
@@ -416,6 +416,7 @@ export function authRouter() {
       interface LoginRequest {
         email: string
         password: string
+        recaptchaToken?: string
       }
       function isValidLoginRequest(obj: any): obj is LoginRequest {
         return (
@@ -430,7 +431,19 @@ export function authRouter() {
           `${env.client.url}/auth/email-login?errorCodes=${LoginErrorCode.InvalidCredentials}`
         )
       }
-      const { email, password } = req.body
+
+      const { email, password, recaptchaToken } = req.body
+      if (process.env.RECAPTCHA_CHALLENGE_SECRET_KEY) {
+        const verified =
+          recaptchaToken && (await verifyChallengeRecaptcha(recaptchaToken))
+        if (!verified) {
+          logger.info('recaptcha failed', { recaptchaToken, verified })
+          return res.redirect(
+            `${env.client.url}/auth/email-login?errorCodes=UNKNOWN`
+          )
+        }
+      }
+
       try {
         const user = await userRepository.findByEmail(email.trim())
         if (!user || user.status === StatusType.Deleted) {
@@ -514,7 +527,7 @@ export function authRouter() {
         const verified =
           recaptchaToken && (await verifyChallengeRecaptcha(recaptchaToken))
         if (!verified) {
-          logger.info('recaptcha failed', recaptchaToken, verified)
+          logger.info('recaptcha failed', { recaptchaToken, verified })
           return res.redirect(
             `${env.client.url}/auth/email-signup?errorCodes=UNKNOWN`
           )
@@ -642,6 +655,17 @@ export function authRouter() {
         )
       }
 
+      const captchaToken = req.body.recaptchaToken as string
+      if (process.env.RECAPTCHA_CHALLENGE_SECRET_KEY) {
+        const verified = await verifyChallengeRecaptcha(captchaToken)
+        if (!verified) {
+          logger.info('recaptcha failed', { captchaToken, verified })
+          return res.redirect(
+            `${env.client.url}/auth/forgot-password?errorCodes=UNKNOWN`
+          )
+        }
+      }
+
       try {
         const user = await userRepository.findByEmail(email)
         if (!user || user.status === StatusType.Deleted) {