skills.rest
nuggocto
nuggoctoCOMMUNITY
Explore all skills by this author →
Website𝕏@nuggoctoGitHub

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, Worker deployment, and frontend integration.

5|Updated Jan 31, 2026
Search Tags:#cloudflare#workers#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/nuggocto/dotfiles --skill turnstile-spin-nuggocto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/nuggocto/dotfiles/tree/main/opencode/skills/turnstile-spin
Command: npx skills add https://github.com/nuggocto/dotfiles --skill turnstile-spin-nuggocto

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires wrangler, degit, and includes scripts (resource) and references (resource) components.

What problem does it solve? Setting up Cloudflare Turnstile bot protection requires many manual steps: creating a widget via the Cloudflare API, deploying a siteverify backend Worker, writing framework-specific frontend snippets, and validating the whole chain. This Skill orchestrates that entire flow so a single prompt like "add Turnstile to my signup form" produces a working, validated integration. ## Core Features & Use Cases - Guided setup wizard: Probes Cloudflare API auth and token scopes, selects the account, registers domains, creates the Turnstile widget, and deploys the managed siteverify Worker with the secret bound securely. - Framework-specific frontend snippets: Ships ready-to-adapt code for vanilla HTML, Next.js (App and Pages Router), Astro, SvelteKit, and Hugo, wiring the widget and gating the existing submit handler on success === true. - Validation and recovery: Runs health, dummy-siteverify, and hostname checks against the deployed Worker, and supports recovering existing widgets without rotating the sitekey, plus migration from reCAPTCHA or hCaptcha. - Use Case: A developer asks their coding agent to "protect my contact form from bots"; the agent scans the codebase, creates the widget, deploys the Worker, edits the form, and confirms validation passes. ## Quick Start Ask your agent to set up Cloudflare Turnstile bot protection on your signup form and let it run the guided wizard end to end.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to my website form?▼

Run this skill's wizard: it probes your Cloudflare API token, creates a Turnstile widget for your domains, deploys the managed siteverify Worker, and inserts the widget snippet into your form. It finishes by validating the deployment with health and dummy-token checks.

How to migrate from reCAPTCHA or hCaptcha to Turnstile?▼

The skill detects existing reCAPTCHA or hCaptcha during its codebase scan and switches to a migration plan. It replaces script tags and widget divs with the Turnstile equivalents, renames the token field to cf-turnstile-response, and points backend verification at the deployed Worker.

What Cloudflare API token permissions does Turnstile setup need?▼

The token needs Account.Turnstile:Edit and Account.Workers Scripts:Edit, with the target account included in Account Resources. The auth-probe script checks both scopes and reports missing_token, missing_scope, or missing_workers_scope so you can fix the token before proceeding.

Does Turnstile Spin work with Next.js, Astro, and SvelteKit?▼

Yes, the skill ships reference snippets for Next.js App Router and Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML. Each snippet shows where to place the widget, how to read the token, and how to call the siteverify Worker from client or server code.

Can I wire siteverify to an existing Turnstile widget without changing the sitekey?▼

Yes, the recovery flow fetches the existing widget's secret and metadata via the Cloudflare API, then deploys the managed Worker against it. The sitekey stays unchanged, and the skill never recreates the widget, which would break existing deployments.

Why does Turnstile validation return missing-input-secret after deploy?▼

This means the TURNSTILE_SECRET_KEY secret did not propagate to the Worker. Re-set it with wrangler secret put using the worker name returned by the deploy script, wait about ten seconds, and re-run the validation script.

Related Skills

Explore More Software Engineering Skills→
MohammedSaudAlsahliMohammedSaudAlsahli

turnstile-spin

Automate Cloudflare Turnstile setup and integration for bot protection.

Community
Advanced
AndreKuraitAndreKurait

agents-optimize

Configure evaluators, observability, and quality gates for AgentCore agents.

Community
Advanced
CarlosCaPeCarlosCaPe

security-audit

Audit contact forms and APIs for security vulnerabilities and anti-bot defenses.

Community
Advanced
brendadeeznuts1111brendadeeznuts1111

cloudflare-turnstile

Integrate Cloudflare Turnstile with server-side Siteverify token validation.

Community
Advanced