Cloudflare Turnstile

#How Cloudflare Turnstile works

A site adds the Turnstile widget to a page. The widget runs its check in the visitor's browser. If the check passes, the widget gives the page a token. The site then sends that token from its own server to Cloudflare, with its secret key, and gets back a yes or no. The server step is the important part. A token on its own proves nothing until the site verifies it.

#Why it matters for AI agents

Turnstile replaces the visible puzzle on many sites, so an agent may meet it where it used to meet a CAPTCHA. The check is built for a person in a normal browser. An agent that reaches it should stop and hand the page to the user. Turnstile is one of several bot checks that sites use, and each one needs the same answer: a person decides what happens next.

#Wield and Cloudflare Turnstile

When a site shows a Turnstile check, Wield stops the run with a site_challenge result. The user solves the check in their own tab. Wield does not solve the check or try to get past it. Recipes run in the user's own browser, with the session the user already has, so the check appears in a place the user can see.

#Related terms

• CAPTCHA: the visible test that Turnstile replaces on many sites.
• Browser fingerprinting: one of the signals sites can use when they decide how to check a visitor.
• Security model: what Wield does and does not do when a site shows a check.

#FAQ

#Is Turnstile a CAPTCHA?

Turnstile is a CAPTCHA alternative. It serves the same purpose, which is telling people apart from automated programs. It asks less of the visitor, because it uses non-interactive or light challenges in place of image puzzles, according to Cloudflare's documentation.

#What does the server verify?

The site's server sends the token it received, along with its secret key, to Cloudflare. Cloudflare answers whether the token is valid. The site should accept the visitor only after that answer comes back valid. A token that the browser holds is not enough on its own.