Cloudflare.Turnstile reference

Widget

Source: packages/cloudflare/src/Turnstile/Widget.ts

A Cloudflare Turnstile widget — Cloudflare’s CAPTCHA alternative.

A widget is identified by its auto-assigned sitekey (the public key you embed in HTML) and produces a secret used server-side against the /turnstile/v0/siteverify endpoint. Name, domains, mode, and clearance settings are all mutable in place; only region forces a replacement.

Widget: Creating a Widget

Managed widget

const widget = yield* Cloudflare.Turnstile.Widget("signup-form", {
  domains: ["example.com"],
  mode: "managed",
});

Invisible widget with an explicit name

const widget = yield* Cloudflare.Turnstile.Widget("api-guard", {
  name: "api-guard",
  domains: ["example.com", "app.example.com"],
  mode: "invisible",
});

Widget: Using the keys

// The sitekey is public — render it in your HTML:
const sitekey = widget.sitekey;

// The secret is redacted — pass it to your server-side verifier:
const secret = widget.secret; // Redacted<string>

Widget: Looking up an existing widget

Widget.lookup references a widget Alchemy doesn’t manage (created in the dashboard or by another stack), found by sitekey or name. It is read during plan/deploy and never created, updated or deleted. Its secret is read too.

const widget = Cloudflare.Turnstile.Widget.lookup({ name: "signup-form" });
const worker = yield* Cloudflare.Worker("Api", {
  main: "./src/api.ts",
  env: { TURNSTILE_SECRET: widget.secret },
});