Back to catalog / Security
Integrate Turnstile: confirm site mode and verify tokens server-side
Use the official scaffold for the selected mode and add reproducible tests.
Skills
Confirm framework, hostname, environment, and widget mode. Read the source references and inspect supported scripts/dependencies before running; never install/create a widget automatically. For an account widget, show hostnames, mode, and resource impact and obtain explicit approval. Send challenge tokens to the app backend, then call official Siteverify server-side with the secret; never expose it in the browser. Run the source test helpers and project tests for valid/invalid tokens, then recheck production hostname and secret configuration before deployment.
Permissions
Prerequisites
- Integrate Turnstile: select widget mode, configure keys, implement client/server verification, and test.
Permissions
- Widget creation changes account resources; site sends challenge tokens to Siteverify.
Limitations
Do not create/install widgets automatically; confirm domains/environment and approval. Siteverify must be server-side; protect secrets.
Pinned upstream source
- Repository
- cloudflare/skills
- File path
- skills/turnstile-spin/SKILL.md
- Pinned commit
53395984c3ea1925d00fce03b266112302f050e6- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: Apache-2.0
Compatible tools
Turnstile dashboard/API · Siteverify API · framework test runner
Main topic
Make Agent behavior safer and easier to verify