skills.rest
vedang
vedangCOMMUNITY
Explore all skills by this author →
Website𝕏@vedangGitHub

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, siteverify Worker deployment, and frontend integration.

13|1|Updated Feb 9, 2026
Search Tags:#cloudflare#workers#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/vedang/dotagents --skill turnstile-spin-vedang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/vedang/dotagents/tree/main/specific_skills/turnstile-spin
Command: npx skills add https://github.com/vedang/dotagents --skill turnstile-spin-vedang

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires wrangler, degit, and includes scripts (resource) and references (resource) components.

What problem does it solve? Setting up Cloudflare Turnstile bot protection requires many manual steps: creating a widget via the Cloudflare API, deploying a siteverify validation backend, wiring frontend snippets, and validating the whole chain. This Skill turns a single prompt like "add Turnstile to my signup form" into a complete, validated integration. ## Core Features & Use Cases - Guided setup wizard: Probes Cloudflare API auth and token scopes, selects the account, registers domains, creates the Turnstile widget, and deploys the managed siteverify Worker via wrangler. - Framework-specific frontend snippets: Ships ready-to-adapt code for vanilla HTML, Next.js (App and Pages Router), Astro, SvelteKit, and Hugo, with a "gate, don't replace" contract that preserves your existing form handler. - Validation and recovery flows: Runs health, dummy-siteverify, and hostname checks after deployment, and supports recovering existing widgets without rotating the sitekey, plus migration from reCAPTCHA or hCaptcha. - Use Case: A developer says "protect my contact form from bots." The agent scans the codebase, creates the widget, deploys the Worker, edits the form to gate submission on success === true, and validates everything before reporting done. ## Quick Start Ask your agent to set up Cloudflare Turnstile bot protection on your signup form and let it run the end-to-end wizard.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to my website form?▼

Run the Turnstile Spin wizard: it probes your Cloudflare API token, creates a widget for your domains, deploys a managed siteverify Worker, and inserts the cf-turnstile snippet into your form. It finishes by validating the deployment with health and dummy-token checks.

How do I migrate from reCAPTCHA or hCaptcha to Turnstile?▼

The skill detects existing reCAPTCHA or hCaptcha during its codebase scan and switches to a migration plan. It replaces script tags and widget divs with the Turnstile equivalents, renames the token field to cf-turnstile-response, and points backend verification at the deployed Worker.

What Cloudflare API token permissions does Turnstile setup need?▼

The token needs Account.Turnstile:Edit and Account.Workers Scripts:Edit, with the target account included in Account Resources. The auth-probe script checks both scopes and reports missing_token, missing_scope, or missing_workers_scope so you can fix the token before proceeding.

Does Turnstile Spin work with Next.js, Astro, SvelteKit, or Hugo?▼

Yes, the skill ships reference snippets for vanilla HTML, Next.js App Router, Next.js Pages Router, Astro, SvelteKit, and Hugo. Each snippet includes the widget markup, the Worker URL target, and variants such as server actions or form actions.

Can I wire siteverify to an existing Turnstile widget without changing the sitekey?▼

Yes, the recovery flow skips widget creation, fetches the existing widget's secret and clearance level via the API, then deploys the Worker and wires the frontend. It never recreates the widget, since that would break the sitekey everywhere it is deployed.

Why does Turnstile validation fail with missing-input-secret after deploy?▼

The Worker's TURNSTILE_SECRET_KEY secret was not set or did not propagate. Re-run wrangler secret put with the widget secret using the worker name returned by the deploy script, wait about ten seconds, and re-run validation.

Related Skills

Explore More Software Engineering Skills→
MohammedSaudAlsahliMohammedSaudAlsahli

turnstile-spin

Automate Cloudflare Turnstile setup and integration for bot protection.

Community
Advanced
george11642george11642
2

deploy-modal

Automate deploying and managing Modal workers, logs, and secrets.

Community
Advanced
mfcollins3mfcollins3

azure-web-application-firewall

Configure and tune Azure WAF policies across Front Door and Application Gateway.

Community
Advanced
ChatAndBuildChatAndBuild
1

cloudflare-deploy

Deploy applications and manage services on Cloudflare using Workers and Pages.

Official
Advanced