Agent skill · marketing growth · secondsky
cloudflare-turnstile
This skill should be used when the user asks to \"add turnstile\", \"implement bot protection\", \"validate turnstile token\", \"fix turnstile error\", \"setup captcha alternative\", or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono.
Why this skill is useful
Provides specific implementation patterns and error handling for integrating Cloudflare Turnstile, which the AI may not reliably generate on its own.
What it needs
Requires cloudflare account access. About 8k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
Cloudflare Turnstile Status: Production Ready ✅ Last Verified: 2025-11-26 Dependencies: None (optional: @marsidev/react-turnstile for React) Contents: Quick Start • Critical Rules • Top 12 Errors • Common Patterns • When to Load References • Troubleshooting --- Quick Start (10 Minutes) 1. Create Turnstile Widget Get your sitekey and secret key from Cloudflare Dashboard. Why this matters: Each widget has unique sitekey/secret pair Sitekey goes in frontend (public) Secret key ONLY in backend (private) Use different widgets for dev/staging/production 2. Add Widget to Frontend Embed the Turnstile widget in your HTML form. CRITICAL: Never proxy or cache api.js - must load from Cloudflare CDN Widget auto-creates hidden input cf-turnstile-response with token Token expires in 5 minutes Each token is single-use only 3. Validate Token on Server ALWAYS validate the token server-side. Client-side verification alone is not secure. --- The 3-Step Setup Process Step 1: Create Widget Configuration 1. Log into Cloudflare Dashboard 2. Navigate to Turnstile section 3. Click "Add Site" 4. Configure: Widget Mode: Managed (recommended), Non-Interactive, or Invisible Domains: Add allowed hostnames (e.g., example.com, localhost for dev) Name: Descriptive name (e.g., "Production Login Form") Key Points: Use separate widgets for dev/staging/production Restrict domains to only those you control Managed mode provides best balance of security and UX localhost must be explicitly added for local testing Step 2: Client-Side Integration Choose between implicit or explicit rendering: Implicit Rendering (Recommended for static forms): Explicit Rendering (For SPAs/dynamic UIs): React Integration (using @marsidev/react-turnstile): Step 3: Server-Side Validation MANDATORY: Always call Siteverify API to validate tokens. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/cloudflare-turnstile