Webform REST reCaptcha post request

I am also having the same impasse!

Perhaps not helpful, but how are you accessing the recaptcha response token? I can't figure that part out.

I too was having this issue, here's the solution I arrived at:
Requirements: Using Gatsby + Webforms + Recaptcha v3 (invisible).

After reviewing captcha and recaptcha_v3 it seems that the verification doesn't work for a headless Drupal site. When following the xdebug path the "captcha" field never makes it into the form_state for future verification. So, it always works.

I ended up using simple_recaptcha because they have a well defined method SimpleReCaptchaFormManager::validateCaptchaToken(). I had to add my own helper module to add my webformelement and webformhandler because simple_Recaptcha adds the form validation to the button and uses ajax in it's provided simple_recaptcha_webform handler.

I created my own WebformElement, "HeadlessCaptcha", to add the headless_captcha element to use, and a WebformHandler "HeadlessCaptchaValidation" to handle the verification (using validateForm() instead of submitForm()).

I've got the front end (gatsby) to generate the token and the backend to send the token via the handler to verify the token. It succeeds when submitting the webform form gatsby, and fails when trying to send the form via Postman (without the captcha token). It also fails if the correct key's aren't present.

Related to this, I was getting this error on a site:

Symfony\Component\Serializer\Exception\NotNormalizableValueException: Could not normalize object of type "Drupal\simple_recaptcha\SimpleReCaptchaFormManager", no supporting normalizer found. in Symfony\Component\Serializer\Serializer->normalize() (line 188 of /var/www/html/vendor/symfony/serializer/Serializer.php).

The solution was to change from reCAPTCHA v2 to v3, then it stopped becoming an issue.