Cloudflare Turnstile
Cloudflare Turnstile is Cloudflare's free, smart CAPTCHA alternative that verifies real users without sending traffic through Cloudflare's network. It runs non-interactive client-side challenges (proof-of-work, proof-of-space, web API probing, browser-integrity checks) and returns a short-lived token that the relying server validates against the Turnstile siteverify endpoint. Turnstile offers three widget modes — Managed (risk-adapted), Non-interactive (no user gesture), and Invisible (fully hidden) — and is designed to run on any website regardless of whether the site is proxied through Cloudflare. The product is targeted at developers who want a privacy-respecting reCAPTCHA replacement.
APIs
Turnstile Siteverify API
The Turnstile siteverify endpoint accepts a token produced by the browser widget along with the site's secret key and an optional remote IP and idempotency key, and returns a JS...
Turnstile Client Widget
The Turnstile client widget renders the challenge in the browser. It is loaded via a script tag at challenges.cloudflare.com/turnstile/v0/api.js and configured with a sitekey, o...
Turnstile Pre-Clearance
Pre-clearance lets a successful Turnstile challenge set a cookie that Cloudflare-proxied properties can honor to skip subsequent bot challenges for the same visitor, which is us...
Cloudflare Turnstile Management API
Turnstile widgets and analytics are managed through the broader Cloudflare API, which exposes endpoints to list, create, update, and rotate Turnstile sitekeys, retrieve analytic...