Cloudflare Turnstile

API

CAPTCHA alternative that checks visitors are human, verified server-side

Price: Free; Enterprise plan via sales
Access: Widget secret key

About

Free Cloudflare widget that checks a visitor is human, usually without a puzzle, plus a siteverify API that validates its tokens on your server. It works on any site without routing traffic through Cloudflare; the free plan allows up to 20 widgets.

What you can do with it

Protect sign-up, login and contact forms from bots without a visual CAPTCHA
Validate widget tokens on your server with the siteverify API before accepting a form
Replace reCAPTCHA or hCaptcha with a privacy-preserving challenge

Get started

Create a widget in the Cloudflare dashboard to get a sitekey and secret
Add the Turnstile script and a cf-turnstile div with your sitekey to the form
Verify each submitted token from your server with siteverify

Example

# Documented test secret and dummy token; use your widget's secret in production
curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify \
  -d secret=1x0000000000000000000000000000000AA \
  -d response=XXXX.DUMMY.TOKEN.XXXX

Details

Hosting: Hosted service
Available in: Worldwide
Official SDKs: JavaScript/TypeScript, Python, Go
MCP server: Remote