skills.rest
tokisakiyuu
tokisakiyuuCOMMUNITY
Explore all skills by this author →
GitHub

turnstile-spin

Automates end-to-end Cloudflare Turnstile setup including widget creation, Worker deployment, and frontend integration.

Updated Nov 23, 2024
Search Tags:#cloudflare#workers#form security#turnstile#bot protection#siteverify#captcha
One-click install
npx skills add https://github.com/tokisakiyuu/dotfiles --skill turnstile-spin-tokisakiyuu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: turnstile-spin
Source: https://github.com/tokisakiyuu/dotfiles/tree/main/home/dot_claude/skills/turnstile-spin
Command: npx skills add https://github.com/tokisakiyuu/dotfiles --skill turnstile-spin-tokisakiyuu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires wrangler, degit, and includes scripts (resource) and references (resource) components.

What problem does it solve? Adding bot protection to a web form with Cloudflare Turnstile normally requires manually creating a widget in the dashboard, writing a siteverify backend, wiring frontend snippets, and verifying everything works. This Skill orchestrates that entire flow through an AI agent, from API authentication to a validated working integration. ## Core Features & Use Cases - Guided multi-step wizard: Probes Cloudflare API auth and token scopes, selects the account, registers domains, creates the widget via the Cloudflare API, and deploys a managed siteverify Worker with the secret set via wrangler. - Framework-specific frontend snippets: Ships reference implementations for vanilla HTML, Next.js (App and Pages Router), Astro, SvelteKit, and Hugo, plus migration guidance from reCAPTCHA and hCaptcha. - End-to-end validation and recovery: Runs health, dummy siteverify, and hostname checks after deployment, and supports a recovery flow that binds siteverify to an existing widget without rotating the sitekey. - Use Case: A user says "protect my signup form from bots." The agent scans the codebase, creates the Turnstile widget, deploys the siteverify Worker, gates the existing submit handler on success === true, and validates the whole chain before reporting done. ## Quick Start Ask the agent to set up Cloudflare Turnstile bot protection on your signup form and follow the confirmation prompts.

Frequently Asked Questions about turnstile-spin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add Cloudflare Turnstile to my website form?▼

Run the Turnstile Spin flow: it probes your Cloudflare API token, creates a widget for your domains, deploys a managed siteverify Worker, and inserts the cf-turnstile widget snippet into your form. The existing submit handler is gated on success === true rather than replaced.

How do I migrate from reCAPTCHA or hCaptcha to Turnstile?▼

Replace the script tag with challenges.cloudflare.com/turnstile/v0/api.js, swap g-recaptcha or h-captcha divs for cf-turnstile with the new sitekey, and point backend verification at the deployed Worker. Note that reCAPTCHA v3 score thresholds have no Turnstile equivalent; it returns success true or false.

What Cloudflare API token permissions does Turnstile setup need?▼

The token needs Account.Turnstile:Edit and Account.Workers Scripts:Edit, with the target account included in Account Resources. The wrangler login OAuth scope does not include these, so a custom API token from the Cloudflare dashboard is required.

Can I use Turnstile Spin with an existing widget and sitekey?▼

Yes, the recovery flow fetches the existing widget's secret and metadata via the API, then deploys the siteverify Worker against it without rotating the sitekey. It only applies when the widget's clearance_level is no_clearance.

Why does Turnstile validation fail with missing-input-secret after deploy?▼

The Worker's TURNSTILE_SECRET_KEY secret did not propagate. Re-set it with wrangler secret put using the worker name returned by the deploy script, wait about ten seconds, then re-run validation.

Does the Turnstile Worker support Next.js, Astro, and SvelteKit?▼

Yes, the skill ships reference snippets for vanilla HTML, Next.js App and Pages Router, Astro, SvelteKit, and Hugo. Each covers client-side widget rendering plus a server-side variant such as Server Actions or form actions that calls the Worker.

Related Skills

Explore More Software Engineering Skills→
MohammedSaudAlsahliMohammedSaudAlsahli

turnstile-spin

Automate Cloudflare Turnstile setup and integration for bot protection.

Community
Advanced
120ventures120ventures

bot-prevention

Integrate Cloudflare Turnstile with a database-backed rate limiter for web forms.

Official
Advanced
AgentiveCityAgentiveCity
2

cloudflare-security-hardening

Configure WAF rules, rate limiting, IP lists, and secure headers for Cloudflare Workers APIs.

Official
Advanced
AgentComputerAIAgentComputerAI
5

2captcha

Solve reCAPTCHA, hCaptcha, and image CAPTCHAs for Puppeteer workflows.

Official
Advanced