skills.rest
sota411
sota411COMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, Worker deployment, and frontend integration.

1|Updated Jul 16, 2026
Search Tags:#cloudflare#workers#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/sota411/codex-config --skill turnstile-spin-sota411
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/sota411/codex-config/tree/main/archived-user-skills/2026-08-20/unused/turnstile-spin
Command: npx skills add https://github.com/sota411/codex-config --skill turnstile-spin-sota411

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires wrangler, degit, and includes scripts (resource) and references (resource) components.

What problem does it solve? Setting up Cloudflare Turnstile bot protection requires many manual steps: creating a widget via the Cloudflare API, deploying a siteverify backend Worker, writing framework-specific frontend snippets, and validating the whole chain. This Skill orchestrates that entire flow so a single request like "add Turnstile to my signup form" produces a working, validated integration. ## Core Features & Use Cases - Guided setup wizard: Probes Cloudflare API auth and token scopes, selects the account, registers domains, creates the Turnstile widget, and deploys the managed siteverify Worker with the secret set via wrangler. - Framework-specific snippets: Ships ready-to-adapt code for vanilla HTML, Next.js (App and Pages Router), Astro, SvelteKit, and Hugo, with a gate-don't-replace contract that preserves existing form handlers. - Validation and recovery: Runs health, dummy siteverify, and hostname checks after deployment, and supports recovery flows for existing widgets plus migration from reCAPTCHA or hCaptcha. - Use Case: A developer asks their coding agent to "protect my contact form from bots"; the agent scans the codebase, creates the widget, deploys the Worker, edits the form, and confirms validation passes. ## Quick Start Ask your agent to set up Cloudflare Turnstile bot protection on your signup or contact form and let it run the end-to-end wizard.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to my website form?▼

Run the Turnstile Spin wizard: it probes your Cloudflare API token, creates a widget for your domains, deploys the managed siteverify Worker, and inserts the cf-turnstile div into your form. Validation checks confirm the integration works before it reports success.

How to migrate from reCAPTCHA or hCaptcha to Cloudflare Turnstile?▼

Replace the script tag with challenges.cloudflare.com/turnstile/v0/api.js, swap g-recaptcha or h-captcha divs for cf-turnstile with your new sitekey, and point backend verification at the deployed Worker. Note that Turnstile returns success true/false and has no reCAPTCHA v3 score thresholds.

What Cloudflare API token permissions does Turnstile setup require?▼

The token needs Account.Turnstile:Edit and Account.Workers Scripts:Edit with the target account in Account Resources. The wrangler login OAuth scope does not include these, so create a custom token in the Cloudflare dashboard instead.

Does Turnstile Spin work with Next.js, Astro, and SvelteKit?▼

Yes, the skill ships reference snippets for Next.js App Router and Pages Router, Astro, SvelteKit, Hugo, and vanilla HTML. Each snippet includes the widget markup, the Worker URL target, and variants like Server Actions or form actions.

Why does Turnstile validation fail with missing-input-secret?▼

This error means TURNSTILE_SECRET_KEY was not set on the deployed Worker. Re-run wrangler secret put with the widget secret piped via stdin, wait about ten seconds for propagation, then re-run the validation script.

Can I use Turnstile Spin with an existing widget and sitekey?▼

Yes, the recovery flow fetches the existing widget's secret and clearance level via the Cloudflare API, then deploys the Worker without recreating the widget. Recreating the widget would break the sitekey everywhere it is already deployed.

Related Skills

Explore More Software Engineering Skills→
MohammedSaudAlsahliMohammedSaudAlsahli

turnstile-spin

Automate Cloudflare Turnstile setup and integration for bot protection.

Community
Advanced
MeoBakaMeoBaka

aws-secrets-rotation

Automate AWS Secrets Manager credential rotation with Lambda templates.

Community
Advanced
YukiIto1999YukiIto1999

securing-api-gateway-with-aws-waf

Configure AWS WAF Web ACLs to protect API Gateway endpoints from web attacks.

Community
Advanced
kartikkabadikartikkabadi

turnstile-spin

Set up Cloudflare Turnstile widgets, Workers, and frontend integration.

Community
Advanced