Frequently Asked Questions

The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page.

We recommend using the nonce-based approach documented with CSP3 Open external link . Make sure to include your nonce in the api.js script tag and we will handle the rest. Cloudflare Turnstile works with strict-dynamic.

Alternatively, add the following values to the directives:

• script-src: https://challenges.cloudflare.com
• frame-src: https://challenges.cloudflare.com

We recommend validating your CSP with Google’s CSP Evaluator Open external link .

A full Turnstile Challenge Token Flow consists of a few things:

• A challenge is rendered (issued).
• A challenge is solved on the front end and a token is harvested (solved).
• The token is passed to siteverify, and it is consumed (siteverified).

Visitor Solve Rate is the percentage of tokens that were issued but have not necessarily been siteverified compared to issued challenges.

API Solve Rate is the share of tokens that were siteverified compared to issued.

Action can be used in analytics and is more limited in size. It should identify different pages in a website where a widget is used.

Action should not contain any personally identifiable information (PII) as this is placed into the analytics.

cData is not stored in our analytics. It can contain data that may vary by each challenge instance.

Both cData and action are returned by the siteverify API if a valid token is presented.

No, the siteverify API will only validate a token once. If a token has already been checked, the siteverify API will yield an error on subsequent verification attempts indicating that a token has already been consumed.

A Turnstile token is valid for 300 seconds.

The Turnstile widget needs to be refreshed to generate a new token. This can be done using the turnstile.reset function.

Turnstile is a front-end widget that creates a token which is cryptographically secured. However, the customer cannot check the validity of the token on their end.

To ensure that a token is not forged by an attacker or has not been consumed yet, the customer needs to check the validity of a token using Cloudflare’s siteverify API.

The siteverify API must not be called by the front end as this may reveal the secretkey used to authenticate. An attacker may simply modify the front end to not perform the siteverify check at all, rendering Turnstile ineffective.

The dummy sitekeys provided below can be used from any domain, including on localhost.

Cloudflare recommends that sitekeys used in production do not allow local domains (localhost, 127.0.0.1), but users can choose to add local domains to the list of allowed domains.

Currently, a Turnstile token can have up to 2048 characters.

Turnstile is hosted under challenges.cloudflare.com.

We currently do not offer an easy and official way to embed Turnstile in a React Native application.

An HTML page rendered in a WebView Open external link can use Turnstile. The page must be loaded from a domain allowed to use the sitekey, either using uri or by specifying the html and baseUrl options.

You can find special sitekeys to be used for testing in the testing section.

Yes, you can refer to the Turnstile API documentation Open API docs link to manage your widgets.

You can safely ignore the error. It is requesting a Private Access Token (PAT) Open external link that your device or browser does not support yet.

You will need to provide a Ray ID or QR code when debugging issues. The Ray ID is found at the end of the challenge page. You can obtain the QR code by clicking the success/failure/spinner logo on the widget four times.

If you encounter an endless challenge loop, try disabling your browser extensions.