Turnstile Siteverify API
The Turnstile siteverify endpoint accepts a token produced by the browser widget along with the site's secret key and an optional remote IP and idempotency key, and returns a JSON verdict with success, hostname, action, cdata, and any error codes. This is the canonical server-side check that authorizes a form submission or API call protected by Turnstile.