AI coding agents can now set up Turnstile for you! Meet Turnstile Spin

Hey everyone, it's Shii-chan! Today I want to share an update from the Cloudflare blog that feels very much of the AI-agent era.

Cloudflare Blog blog.cloudflare.com

What was announced?

On the Cloudflare Engineering blog, a new feature called "Turnstile Spin" was announced. It's an agent-mediated way to set up Turnstile, Cloudflare's bot-protection product, using the AI coding agent you already have on hand.

Turnstile launched in 2023 as a privacy-first, client-side challenge. It's free to use, doesn't require proxying your traffic through Cloudflare, and never makes visitors solve a puzzle. Today it processes about three billion verifications on a typical weekday, and in one recent week alone, more than 23,000 accounts created a new widget in the dashboard.

Why it matters

Setting up Turnstile properly requires two steps: embedding the widget on your frontend, and posting the resulting token to the Siteverify API from your backend to verify it. But a lot of people skip that backend step, ending up with a widget that looks set up but isn't actually protecting anything.

Cloudflare points to the rise of AI as the reason this matters more now, what the post calls "AI raises the stakes." AI coding agents let more people build applications without deep backend knowledge, but that same shift gives attackers more ways to automate abuse too. So the goal here is to make sure Turnstile itself can be installed correctly through an AI agent, not just by hand.

What changes

With Turnstile Spin, that two-step setup becomes a guided workflow with your coding agent. You tell it where you want protection, and the agent locates the relevant frontend and backend code, proposes an implementation plan, and after you approve it, implements both sides together. Someone without backend experience can now finish the setup correctly, while experienced developers can skip the repetitive parts and still catch anything they might have missed.

On the safety side, Spin does not send your application code to Cloudflare or let Cloudflare change it remotely. The actual changes are made by the agent you already use, whether that's Claude Code, Cursor, Codex, or something else. The only new resource created in your Cloudflare account is the Turnstile widget itself; the validation logic stays in your own backend.

Dive Deep

Turnstile Spin adapts to three different situations depending on what it finds in your codebase:

• Fresh install: No CAPTCHA in place yet. The agent embeds the widget on your frontend and wires Siteverify into your backend from scratch.
• Widget recovery: Cloudflare monitors Siteverify calls for each widget, and any widget serving traffic without server-side validation gets a "Fix with Spin" banner in the dashboard. The agent reuses the same secret and adds just the missing backend step, while the widget keeps serving traffic the whole time.
• Migration from CAPTCHA: The agent detects markers of an existing CAPTCHA provider, proposes a substitution plan, and applies it once you approve. Existing Turnstile migration docs still cover tool-specific details.

You can start Spin from the Cloudflare dashboard, from Wrangler, or by pasting a public skill URL directly into your agent. The typical flow is to start from the dashboard, paste the skill URL into your agent, and let Wrangler handle the rest of the steps.

Early results

Turnstile Spin has actually been live since July, and since then the dashboard has recorded more than 65,000 successful Spin widget creations, with developers copying the generated prompt more than 30,000 times. Those numbers suggest that building Turnstile directly into AI workflows really did fill a need developers had.

Wrap-up

• Cloudflare announced Turnstile Spin, which lets an AI coding agent implement Turnstile for you
• The agent handles both the frontend widget and backend Siteverify validation together, with your approval
• Your application code is never sent to Cloudflare; changes happen inside your own agent
• It supports three scenarios: fresh install, widget recovery, and migration from another CAPTCHA
• Since launch, it has powered more than 65,000 successful widget creations

If you've ever thought you'd finished setting up Turnstile only to realize you forgot the backend validation step, this update is exactly for you!