cloudflare-turnstile

Cloudflare Turnstile protects forms and login flows by embedding a client-side widget and validating tokens server-side. Render the widget on your frontend, collect the token, and verify it on your server using the Siteverify API with your secret key to confirm the request is legitimate.

Yes, Turnstile integrates with React, Next.js, and Hono. The Skill covers widget embedding patterns for each framework, including implicit and explicit rendering modes, plus server-side validation examples for all three platforms.

Implicit mode auto-renders the widget when the script loads; explicit mode gives you control over render timing via JavaScript; React mode uses framework-specific components. Each mode suits different application architectures and rendering strategies.

Turnstile error handling involves catching framework-specific callbacks and referencing Turnstile error codes. Token lifecycle management includes validating tokens server-side before expiration and implementing retry logic for failed validations or network issues.

Turnstile requires specific CSP directives to function. The Skill provides CSP snippets and guidance for script sources, frame sources, and style sources needed to run Turnstile without relaxing security posture.

Yes, migration from reCAPTCHA to Turnstile is covered in the Skill. The process involves replacing widget script references, updating sitekey and secret values, and adapting server-side validation logic to use Turnstile's Siteverify endpoint.