Questions? hello@viberation.devGet supportBlogDocsChangelog

Colour mode

XGitHub
Get started

Turnstile Setup

Skills#backend#frontend

Add Cloudflare Turnstile bot protection to your forms.

Cloudflare's skill for setting up, repairing or migrating to Turnstile bot verification in an existing frontend and backend, including the server-side Siteverify check.

Install this skill

npx skills add https://github.com/cloudflare/skills --skill turnstile-spin

Runs the open-source skills CLI in your own terminal. It asks which agents to add the skill to. Read what it tells your agent to do before you install it.

Download skill (.zip)

Install for your agent

  • Claude Code

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a claude-code

    Add -g to install it for every project instead.

    Or ask Claude Code to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for Claude Code.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .claude/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .claude/skills/ for this project, or ~/.claude/skills/ for all your projects.

    Picked up in the current session, no restart needed.

    Claude Code skills docs
  • Claude.ai

    Upload the ZIP

    1. In Settings > Capabilities, turn on Code execution and file creation.
    2. Go to Customize > Skills, press +, then Create skill.
    3. Choose Upload a skill and pick the ZIP you downloaded.

    Free, Pro and Max plans. On Team and Enterprise, an owner turns skills on in Organization settings first.

    Claude.ai skills docs
  • ChatGPT

    Upload the ZIP

    1. Open Skills in ChatGPT and select Create.
    2. Select Upload from your computer and pick the ZIP you downloaded.
    3. Wait for ChatGPT's safety scan. A skill marked Needs Review asks you to check it before use.

    Skills that rely on scripts or a terminal may not work unchanged in ChatGPT.

    ChatGPT skills docs
  • Codex

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a codex

    Add -g to install it for every project instead.

    Or ask Codex to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for Codex.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .agents/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .agents/skills/ for this project, or ~/.agents/skills/ for all your projects.

    Restart Codex if the skill does not show up.

    Codex skills docs
  • Cursor

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a cursor

    Add -g to install it for every project instead.

    Or ask Cursor to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for Cursor.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .cursor/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .cursor/skills/ for this project, or ~/.cursor/skills/ for all your projects.

    Run it by typing / and the skill name in chat.

    Cursor skills docs
  • GitHub Copilot

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a github-copilot

    Add -g to install it for every project instead.

    Or ask GitHub Copilot to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for GitHub Copilot.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .github/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .github/skills/ for this project, or ~/.copilot/skills/ for all your projects.

    Works in Copilot CLI, the cloud agent and agent mode in VS Code and JetBrains.

    GitHub Copilot skills docs
  • Antigravity

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a antigravity

    Add -g to install it for every project instead.

    Or ask Antigravity to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for Antigravity.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .agents/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .agents/skills/ for this project, or ~/.gemini/config/skills/ for all your projects.

    Antigravity skills docs
  • Gemini CLI

    Run this in your project

    npx skills add https://github.com/cloudflare/skills --skill turnstile-spin -a gemini-cli

    Add -g to install it for every project instead.

    Or ask Gemini CLI to do it

    Install the "turnstile-spin" skill from https://github.com/cloudflare/skills for Gemini CLI.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .gemini/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .gemini/skills/ for this project, or ~/.gemini/skills/ for all your projects.

    Run /skills to check it was found.

    Gemini CLI skills docs
Installs
56K via skills.sh
GitHub
2.8K stars ↗
Last updated
8 Sept 2026
Licence
Apache-2.0

Security checks

Run by independent scanners and published on skills.sh. Their results, not a Viberation review.

  • Gen Agent Trust Hub Pass

    This skill facilitates the end-to-end setup of Cloudflare Turnstile and includes security considerations such as the retrieval of configuration from external sources and the scanning of repository files for project identification. These actions are performed using robust security practices, including isolated command execution and sensitive data handling. See the detailed analysis for context.

    6 Sept 2026

  • Socket Pass

    No alerts

    6 Sept 2026

  • Snyk Pass

    Risk: LOW · No issues

    6 Sept 2026
What's inside (13 files)
  • README.md3.8K chars
  • references/astro.md5.9K chars
  • references/hugo.md3.8K chars
  • references/nextjs-app.md7.6K chars
  • references/nextjs-pages.md2.7K chars
  • references/sveltekit.md5.5K chars
  • references/vanilla-html.md5.8K chars
  • scripts/auth-probe.sh11.3K chars
  • scripts/persist-skill.sh3.6K chars
  • scripts/validate.sh4.4K chars
  • scripts/widget-create.sh4.1K chars
  • SKILL.md28.6K chars
  • tests/validation.md2.9K chars

SKILL.md, first part. Shown as plain text.

---
name: turnstile-spin
description: Set up, repair, or migrate to Cloudflare Turnstile bot verification in an existing frontend and backend, including server-side Siteverify.
---

# Turnstile Spin skill

Turns the prompt "set up Turnstile" into a working end-to-end integration: a widget, frontend snippets at every chosen insertion point, canonical server-side siteverify in the customer's existing backend, and a real validation pass before reporting success.

You are the agent. Run the wizard below by invoking the scripts under `scripts/` and branching on their JSON output. The scripts hold the deterministic logic (API calls, retry/error handling); your job is orchestration, codebase reading, confirmation, and the frontend + backend edits.

This file is the canonical machine-readable behavior. Product requirements come from the [Turnstile documentation](https://developers.cloudflare.com/turnstile/), and the hosted prompt must mirror this behavior.

## Framework references

Read the reference for the existing frontend when wiring the integration:

| Frontend | Reference |
|---|---|
| Vanilla HTML | [vanilla-html](references/vanilla-html.md) |
| Next.js App Router | [nextjs-app](references/nextjs-app.md) |
| Next.js Pages Router | [nextjs-pages](references/nextjs-pages.md) |
| Astro | [astro](references/astro.md) |
| SvelteKit | [sveltekit](references/sveltekit.md) |
| Hugo | [hugo](references/hugo.md) |

## When to load this skill

Load when the user's prompt mentions any of:

- "Turnstile", "CAPTCHA", "bot protection"
- "siteverify", "cf-turnstile-response"
- "protect this form", "protect this endpoint", "protect this button", "stop bot signups", "spam signups", "block bots on <target>"
- A specific signup, login, contact form, download, comment, API endpoint, or other user-triggered request combined with "Cloudflare" or "bot"

Do not load for unrelated Cloudflare tasks (Workers, Pages, R2, etc.) unless Turnstile is also mentioned.

## Choose the flow before responding

Inspect the user's prompt before starting the numbered wizard. If it says the widget is already created and provides one or more sitekeys, go directly to the existing-widget flow below. Do not run, summarize, or propose the widget-creation flow. Otherwise, use the numbered creation wizard.

## Conversation flow

The user pasted the prompt. You are in a multi-step dialog. Detect what you can, ask only when you have to, confirm before every irreversible step. Each numbered moment is one agent message. Items marked **[wait for user]** require a user response.

1. **Brief acknowledge.** One sentence: "I'll run Turnstile setup end to end. That's: check auth, scan the codebase, create the widget, embed it where visitor requests need verification, wire server-side siteverify, validate. Proceed?" **[wait for user]** Do NOT present a plan yet. Auth + scan come first.

2. **CLI check.** Spin's helper scripts use `curl` against `api.cloudflare.com`. Account enumeration requires either an explicit `$CLOUDFLARE_ACCOUNT_ID` or a user-approved canonical absolute `WRANGLER_BIN` outside the project with exact `WRANGLER_VERSION`. Never use `npx`, `pnpm exec`, a package script, a project-local binary, or an unapproved executable for a credential-bearing command. Never install Wrangler automatically during the flow.

3. **Auth + scope probe (FIRST irreversible action).** Run `scripts/auth-probe.sh`. If account enumeration needs Wrangler, set `PROJECT_ROOT`, approved canonical `WRANGLER_BIN`, and exact `WRANGLER_VERSION` first. Branch on `status`:
   - `ok`: continue to Step 4. The script already picked the account (single-account token, or one matching `$CLOUDFLARE_ACCOUNT_ID`).
   - `missing_token` or `missing_scope`: ask the user to create a token at https://dash.cloudflare.com/profile/api-tokens → Custom token → permission `Account.Turnstile:Edit` → include the target account in Account Resources. **Do NOT direct them to `wrangler login`** unless wrangler's OAuth scope include

Key info

Pricing
Open source
Category
Skills

Related reading

  • Fundamentals

    Row level security is the security boundary

    If your database rows are protected by a check in your application code, they are not protected. Anything holding a key can talk to the database directly, an…

    Expert

More in Skills