skills.rest
leonardoacosta
leonardoacostaCOMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Set up Cloudflare Turnstile end-to-end with widget creation, siteverify wiring, and validation.

Updated Aug 2, 2026
Search Tags:#cloudflare#wrangler#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/leonardoacosta/agents --skill turnstile-spin-leonardoacosta
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/leonardoacosta/agents/tree/main/skills/turnstile-spin
Command: npx skills add https://github.com/leonardoacosta/agents --skill turnstile-spin-leonardoacosta

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Adding bot protection to forms and endpoints requires coordinating Cloudflare API credentials, widget creation, frontend embeds, and server-side siteverify validation, which is error-prone when done manually. ## Core Features & Use Cases - Guided setup wizard: Probes API token scope, scans the codebase for framework and backend handlers, creates the Turnstile widget via the Cloudflare API or Wrangler, and embeds it at chosen surfaces. - Canonical server-side validation: Wires siteverify into the existing backend handler with success, action, and hostname checks, keeping secrets out of chat, logs, and command arguments. - Framework references and migration: Provides snippets for Next.js App/Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML, plus reCAPTCHA and hCaptcha migration guidance. - Use Case: A user asks to protect a signup form from bots; the skill creates the widget, embeds it in the form, gates the existing handler on siteverify, and validates with a real token including replay rejection. ## Quick Start Ask the agent to set up Cloudflare Turnstile on your signup form and protect it from bot submissions.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to a form?▼

Run the setup wizard: it probes your API token, scans the codebase, creates a widget via the Cloudflare API, embeds the widget in your form, and adds a siteverify check inside your existing backend handler. Validation with a real token confirms the integration works.

How do I migrate from reCAPTCHA or hCaptcha to Turnstile?▼

The skill detects existing reCAPTCHA or hCaptcha during its codebase scan and switches to a migration plan. It replaces script tags and widget divs, renames the token field to cf-turnstile-response, and repoints the backend verify call to the Turnstile siteverify endpoint.

Does Turnstile work with Next.js, Astro, SvelteKit, and Hugo?▼

Yes, the skill ships reference snippets for Next.js App Router and Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML. Each reference shows the frontend widget embed and the matching server-side siteverify call for that framework.

What Cloudflare API token permissions does Turnstile setup need?▼

The token needs the Account.Turnstile:Edit permission with the target account included in Account Resources. The auth-probe script verifies this scope by posting an intentionally invalid widget payload and interpreting the API response.

Why does Turnstile validation return invalid-input-secret?▼

The invalid-input-secret error means the secret did not reach your backend correctly. Check that TURNSTILE_SECRET is set in your environment or secret manager, and for Workers confirm with wrangler secret list that the secret is bound to the right script.

Can Turnstile protect a static site with no backend?▼

No, Turnstile requires a server-side endpoint to call siteverify, so a pure-static site or mailto-only form cannot be protected. The skill exits in that case rather than deploying extra infrastructure like Workers or proxies.

Related Skills

Explore More Software Engineering Skills→
lettucebolettucebo

turnstile-spin

Set up Cloudflare Turnstile bot protection end-to-end with widget creation, siteverify wiring, and validation.

Community
Advanced
nirholasnirholas
288

traffic-surge-runbook

Guide emergency teams through traffic surge stabilization with caching, rate limiting, scaling, and endpoint management.

Community
Advanced
YukiIto1999YukiIto1999

securing-api-gateway-with-aws-waf

Configure AWS WAF Web ACLs to protect API Gateway endpoints from web attacks.

Community
Advanced
vedangvedang
13

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, siteverify Worker deployment, and frontend integration.

Community
Advanced