turnstile-spin
Set up Cloudflare Turnstile end-to-end in a project. Scan the codebase, create the widget via the Cloudflare API, embed it where user requests need bot verification (form submissions, SPA actions, API endpoints, download links, comment or vote submissions, etc.), wire canonical server-side siteverify in the customer's existing backend, validate, and persist the skill. Load this when a user asks to add Turnstile, set up CAPTCHA, protect a form or endpoint from bots, or fix a Turnstile integration. Mirrors developers.cloudflare.com/turnstile/spin.
Profile →npx skills add cloudflare/skills --skill turnstile-spin --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Turns prompt about Turnstile into a full end-to-end integration: creates a Turnstile widget via the Cloudflare API, embeds frontend snippets at insertion points, wires a canonical server-side siteverify in the customer's backend, and validates the flow before reporting success. It orchestrates a wizard-driven process with scripts to perform account/auth checks, codebase scanning, widget creation, and backend verification. The skill activates when the user asks to add Turnstile, set up CAPTCHA, protect a form or endpoint from bots, or fix an integration.
How it works
- It runs a multi-step wizard controlled by scripts under scripts/ to perform actions like authentication probing and widget creation.
- It requires explicit prompts to begin irreversible actions and branches behavior based on the CLI outputs and account state.
- It performs an account probe via scripts/auth-probe.sh and handles various outcomes (ok, missing_token, network_failure, multiple_accounts, account_mismatch).
- It scans the codebase to determine frontend framework, backend handler location, and any existing CAPTCHA to decide the insertion and migration path.
- It presents an insertion plan with surface mappings, then creates the widget using Wrangler if available or a fallback script, and extracts SITEKEY and WIDGET_SECRET from the response.
- It wires the integration by embedding the widget at chosen surfaces and adding a canonical siteverify call in the existing backend handler. It defines a Node/Fetch-style siteverify routine that validates token, action, and hostnames before proceeding with existing handler logic.
- It stores the TURNSTILE_SECRET in the appropriate secret store (env file or platform secret manager) after ensuring the project is git-ignored for secret files. It validates the secret storage flow and performs end-to-end validation steps for the new widget setup.
- It guides persists by offering to save the Spin skill to the repository path and reports back with a final status.
When to use it
Load when the user asks to add Turnstile, set up CAPTCHA, protect a form or endpoint from bots, or fix a Turnstile integration. It mirrors Turnstile spin references and requires the user to proceed through the wizard steps to complete auth, codebase analysis, widget creation, and integration wiring.
What it can touch
- Interacts with scripts under scripts/ for authentication and widget creation.
- Uses Wrangler executable (WRANGLER_BIN) or a fallback script path to perform widget creation, and reads/writes to environment and secret stores as described (TURNSTILE_SECRET, TURNSTILE_HOSTNAMES).
- Writes diffs and possibly diffs for the integration changes and stores the final skill in the repository as a record of the exact steps performed.
Caveats
- The process requires user confirmation for irreversible steps and explicit handling of API tokens and secrets without printing them in chat.
- It strictly enforces that secrets are not written to disk except via the user’s own env/secret store or the platform’s secret manager and never echoed in the chat.
- It avoids using npx, pnpm exec, package scripts, or unapproved executables for credential-bearing commands and prohibits automatic Wrangler installation during flow.
# Turnstile Spin skill Turns the prompt "set up Turnstile" into a working end-to-end integration: a widget, frontend snippets at every chosen insertion point, canonical server-side siteverify in the customer's existing backend, and a real validation pass before reporting success. You are the agent. Run the wizard below by invoking the scripts under `scripts/` and branching on their JSON output. The scripts hold the deterministic logic (API calls, retry/error handling); your job is orchestration, codebase reading, confirmation, and the frontend + backend edits. This file is the canonical machine-readable behavior. Product requirements come from the [Turnstile documentation](https://developers.cloudflare.com/turnstile/), and the hosted prompt must mirror this behavior. ## When to load this skill Load when the user's prompt mentions any of: - "Turnstile", "CAPTCHA", "bot protection" - "siteverify", "cf-turnstile-response" - "protect this form", "protect this endpoint", "protect this button", "stop bot signups", "spam signups", "block bots on <target>" - A specific signup, login, contact form, download, comment, API endpoint, or other user-triggered request combined with "Cloudflare" o
- When to load this skill
- Choose the flow before responding
- Conversation flow
- Things you must NOT do
- Hard scope boundary: DO NOT ask the user about
- Existing-widget flow: retrieve and store the secret without chat
- The frontend-edit contract
- Migrating from another CAPTCHA
- Edge cases
set -o pipefail
jq -e --arg sitekey "$SITEKEY" --argjson expected "$EXPECTED_DOMAINS_JSON" '
then {
else error("widget metadata validation failed")
end
set +x
set -euo pipefail
export WRANGLER_WRITE_LOGS=false
export WRANGLER_LOG=log
export WRANGLER_LOG_SANITIZE=trueWhat does the turnstile-spin skill do?
Set up Cloudflare Turnstile end-to-end in a project. Scan the codebase, create the widget via the Cloudflare API, embed it where user requests need bot verification (form submissions, SPA actions, API endpoints, download links, comment or vote submissions, etc.), wire canonical server-side siteverify in the customer's existing backend, validate, and persist the skill. Load this when a user asks to add Turnstile, set up CAPTCHA, protect a form or endpoint from bots, or fix a Turnstile integration. Mirrors developers.cloudflare.com/turnstile/spin.
How do I install it?
Run `npx skills add cloudflare/skills --skill turnstile-spin --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From cloudflare/skills, a repository with 2,539 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.