# Cloudflare Turnstile

**Canonical:** https://apis.io/providers/cloudflare-turnstile/  
**APIs profiled:** 5

Cloudflare Turnstile is Cloudflare's free, smart CAPTCHA alternative that verifies real users without sending traffic through Cloudflare's network. It runs non-interactive client-side challenges (proof-of-work, proof-of-space, web API probing, browser-integrity checks) and returns a short-lived token that the relying server validates against the Turnstile siteverify endpoint. Turnstile offers three widget modes — Managed (risk-adapted), Non-interactive (no user gesture), and Invisible (fully hidden) — and is designed to run on any website regardless of whether the site is proxied through Cloudflare. The product is targeted at developers who want a privacy-respecting reCAPTCHA replacement.

## Kin Score — 32.7 / 100 (thin)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 32.7).

| Facet | Score |
|---|---|
| Discoverability | 81.5 |
| Contract Quality | 47.6 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 23.7 |
| Developer Ergonomics | 19.0 |
| Commercial Clarity | 28.9 |
| Access Clarity | 28.9 |

## Agent readiness — 28.2 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | verified |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Free — onboarding: unknown, pricing: free, trial: no (confidence: medium).

## APIs (5)

- **Turnstile Siteverify API** — The Turnstile siteverify endpoint accepts a token produced by the browser widget along with the site's secret key and an optional remote IP and idempotency key, and returns a JS...
- **Turnstile Client Widget** — The Turnstile client widget renders the challenge in the browser. It is loaded via a script tag at challenges.cloudflare.com/turnstile/v0/api.js and configured with a sitekey, o...
- **Turnstile Pre-Clearance** — Pre-clearance lets a successful Turnstile challenge set a cookie that Cloudflare-proxied properties can honor to skip subsequent bot challenges for the same visitor, which is us...
- **Cloudflare Turnstile Management API** — Turnstile widgets and analytics are managed through the broader Cloudflare API, which exposes endpoints to list, create, update, and rotate Turnstile sitekeys, retrieve analytic...
- **Cloudflare Turnstile Verification API** — The Verification API from Cloudflare Turnstile — 1 operation(s) for verification.

## Agentic access (1)

- **Cloudflare Turnstile Agentic Access** — 1 operation · 1 acting

## Security (2)

- **Cloudflare Turnstile Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Cloudflare Turnstile Vulnerability Disclosure** — Hackerone · security.txt · contact published

## Plans (1)

- **Cloudflare Turnstile Plans Pricing**

## Tags

CAPTCHA, Bot Defense, Cloudflare, Turnstile, Privacy, reCAPTCHA Alternative, Edge Security

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/cloudflare-turnstile/). Scores are computed from the provider's own public artifacts under a published rubric.