skills.rest
Aki2022
Aki2022COMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Sets up Cloudflare Turnstile end-to-end with widget creation, frontend embeds, and server-side siteverify validation.

Updated Dec 9, 2025
Search Tags:#cloudflare#form security#turnstile#bot protection#setup wizard#siteverify#captcha
One-click install
npx skills add https://github.com/Aki2022/skills --skill turnstile-spin-aki2022
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/Aki2022/skills/tree/main/turnstile-spin
Command: npx skills add https://github.com/Aki2022/skills --skill turnstile-spin-aki2022

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Adding bot protection to forms and endpoints requires coordinating Cloudflare API credentials, widget creation, frontend embed code, and server-side token verification. This Skill automates that entire Turnstile integration workflow so a single request produces a working, validated setup. ## Core Features & Use Cases - Guided setup wizard: Probes API token scope, selects the account, registers domains, creates the Turnstile widget via the Cloudflare API or Wrangler, and stores the secret without exposing it in chat or logs. - Framework-specific integration: Ships ready-made embed and siteverify snippets for Next.js (App and Pages Router), Astro, SvelteKit, Hugo, and vanilla HTML, wiring verification into the project's existing backend handler. - Validation and migration: Runs a dummy-siteverify plus hostname check, exercises the real backend with a fresh token, and supports migrating existing reCAPTCHA or hCaptcha integrations to Turnstile. - Use Case: Ask the agent to protect a signup form from bots; it scans the codebase, creates the widget, embeds it in the form, adds canonical siteverify to the existing handler, and confirms a real token passes while a replayed token is rejected. ## Quick Start Ask the agent to set up Cloudflare Turnstile bot protection on your signup or contact form and confirm each wizard step as prompted.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to a form?▼

Run the setup wizard, which probes your API token, creates a widget for your domains, embeds the cf-turnstile div in the form, and adds a siteverify call to your existing backend handler. It finishes by validating the integration with a real token.

How do I migrate from reCAPTCHA or hCaptcha to Turnstile?▼

The wizard detects existing reCAPTCHA or hCaptcha code during its codebase scan and switches to a migration plan. It swaps script tags and widget divs, renames the token field to cf-turnstile-response, and repoints the backend verification to the Turnstile siteverify endpoint.

Does Turnstile work with Next.js, Astro, or SvelteKit?▼

Yes, the skill ships reference snippets for Next.js App Router and Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML. Each reference shows the client-side widget embed plus the matching server-side siteverify handler for that framework.

Can I use Turnstile on a static site with no backend?▼

No, siteverify is server-side by design, so a pure-static site cannot complete the integration. The skill exits in that case and suggests adding a Cloudflare Pages Function, a small Worker, or a form host with a server-side hook.

Why does Turnstile validation return invalid-input-secret?▼

That error means the secret never reached your backend. Re-check the TURNSTILE_SECRET value in your environment or secret manager, and for Workers run wrangler secret list to confirm the secret is bound to the correct script.

How is the Turnstile secret handled during setup?▼

The secret is never printed in chat, written to logs, or placed in command arguments. It moves through standard-input pipes into your own env file or secret store, and the wizard asks you to provide API tokens via shell export rather than pasting them.

Related Skills

Explore More Software Engineering Skills→
lettucebolettucebo

turnstile-spin

Set up Cloudflare Turnstile bot protection end-to-end with widget creation, siteverify wiring, and validation.

Community
Advanced
xalgordxalgord
954

implementing-cloud-waf-rules

Deploy and tune WAF rules on AWS WAF, Azure WAF, and Cloudflare against OWASP Top 10 attacks.

Community
Intermediate
AgentiveCityAgentiveCity
2

cloudflare-security-hardening

Configure WAF rules, rate limiting, IP lists, and secure headers for Cloudflare Workers APIs.

Official
Advanced
emersoftwareemersoftware
1

turnstile-spin

Deploys Cloudflare Turnstile bot protection with widget creation and managed Worker siteverify.

Community
Advanced