---
id: "cloudflare-turnstile"
type: "component"
kind: "bot-management"
provider: "cloudflare"
category: "security"
docs: "https://developers.cloudflare.com/turnstile/get-started/server-side-validation/"
url: "https://localhost:3000/catalogue/components/cloudflare-turnstile"
---

# Cloudflare Turnstile

CAPTCHA alternative that verifies visitors with invisible JavaScript challenges and a short-lived token.

| | |
|---|---|
| Provider | [cloudflare](https://localhost:3000/catalogue?provider=cloudflare) |
| Kind | [Bot management](https://localhost:3000/catalogue/kinds/bot-management) |
| Category | Security |
| Official docs | [https://developers.cloudflare.com/turnstile/get-started/server-side-validation/](https://developers.cloudflare.com/turnstile/get-started/server-side-validation/) |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `challengeAction` | enum | `block`, `managed-challenge`, `js-challenge`, `captcha`, `log` | no | — | **"managed-challenge"** |
| `jsDetections` | boolean | — | no | — | **true** |
| `machineLearning` | boolean | — | no | — | inherited |
| `managed` | boolean | — | no | false | **true** |
| `preClearance` | boolean | — | no | false | inherited |
| `scoreHeader` | boolean | — | no | — | inherited |
| `scoreThreshold` | integer | — | no | — | inherited |
| `sessionTokenLifetimeMinutes` | integer | — | no | — | **5** |
| `singleUseToken` | boolean | — | no | true | inherited |
| `verifiedBotsAllowed` | boolean | — | no | true | inherited |
| `widgetMode` | enum | `managed`, `non-interactive`, `invisible` | no | "managed" | inherited |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 3

- [AI Crawl Control](https://localhost:3000/catalogue/components/cloudflare-ai-crawl-control.md) `cloudflare-ai-crawl-control` — cloudflare
- [Cloudflare Bot Management](https://localhost:3000/catalogue/components/cloudflare-bot-management.md) `cloudflare-bot-management` — cloudflare
- [Generic bot management](https://localhost:3000/catalogue/components/bot-management.md) `bot-management` — default

## Use it in a design

```yaml
nodes:
  - { id: "cloudflare-turnstile", component: "cloudflare-turnstile" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Cloudflare Turnstile: a CAPTCHA alternative that runs non-interactive JavaScript challenges and
# only shows a checkbox when the managed widget decides the visitor is risky ("Turnstile overview");
# a widget token is valid for 300 seconds and may be redeemed once ("Server-side validation").
schemaVersion: "1"
type: "component"
id: "cloudflare-turnstile"
kind: "bot-management"
provider: "cloudflare"
docs: "https://developers.cloudflare.com/turnstile/get-started/server-side-validation/"
defaults:
  managed: true
  challengeAction: "managed-challenge"
  jsDetections: true
  sessionTokenLifetimeMinutes: 5
properties:
  widgetMode:
    type: "enum"
    values: ["managed", "non-interactive", "invisible"]
    default: "managed"
  singleUseToken:
    type: "boolean"
    default: true
  preClearance:
    type: "boolean"
    default: false
```

Human page: https://localhost:3000/catalogue/components/cloudflare-turnstile