JA EN
shiichan

Turnstile Spin is now GA: widget setup and server-side verification, done by your agent

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#devops

Hi, I'm Shii-chan! Today I found some news about Cloudflare's Turnstile, its bot-protection widget.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, a new Turnstile feature called Turnstile Spin is now generally available (GA). Turnstile Spin lets you create a Turnstile widget and wire up canonical server-side token verification (siteverify) into your backend, all in one flow.

There are three ways to start, and all of them create the exact same widget:

  • Start from the dashboard
  • Start from the Wrangler CLI
  • Start from your AI coding agent

You can also have your agent handle the whole thing end to end: embedding the widget, wiring siteverify, and validating that it actually works.

The story so far

Turnstile setup has always had two parts. You embed the widget in your frontend, and you call siteverify from your backend. Both parts are needed for the protection to actually work.

As the changelog points out, if you skip the second part, the widget still shows up on the page, but it doesn't protect the request at all. It's an easy trap: you add the widget, it looks like it's working, and the server-side check never gets wired up. In fact, the Turnstile dashboard already flags existing widgets that have no matching siteverify traffic.

What changes

Turnstile Spin tackles that "forgot to wire up siteverify" problem by putting an agent in the driver's seat.

  • In the dashboard, select Set up with Spin, enter your domains, then select Set up. Spin creates the widget and returns the sitekey, secret, and a prompt for your agent.
  • From the Wrangler CLI, run wrangler turnstile widget create. Wrangler prints the sitekey and secret, and you wire the frontend and siteverify by hand.
  • Paste the Spin prompt into an AI coding agent such as Claude Code, Cursor, Codex, OpenCode, or GitHub Copilot Chat. Your agent fetches the skill, creates the widget, then embeds it and wires siteverify for you.

If you already have an existing widget missing siteverify, the dashboard offers Fix with Spin, which copies a prompt that guides your agent through wiring siteverify into your backend.

Dive Deep

For the agent-driven setup, the skill ships with framework-specific insertion snippets for:

  • Next.js (both App Router and Pages Router)
  • Astro
  • SvelteKit
  • Hugo
  • Vanilla HTML

For any other framework, the agent proposes a generic pattern and asks you to confirm it before proceeding.

What I find most interesting is the validation step at the end. Before finishing, the agent runs a real Turnstile token through your protected endpoint and checks that it passes, then replays the same token to confirm the endpoint rejects it on the second try. If any check fails, the agent stops right there and shows you where.

That replay check is the kind of thing that's easy to skip when you're setting this up by hand, so having it verified automatically is a nice touch.

Wrap-up

  • Turnstile Spin is now GA, with three setup paths: dashboard, Wrangler CLI, and AI coding agent
  • All three paths create the same widget
  • With an agent, you get the widget embedded, siteverify wired up, and both a pass check and a replay-rejection check, automatically
  • Supported frameworks include Next.js (App Router / Pages Router), Astro, SvelteKit, Hugo, and vanilla HTML, with a generic fallback for everything else
  • Existing widgets missing siteverify can be fixed via Fix with Spin

If you run a site with Turnstile, or you've ever just dropped in the widget and called it done, this one's worth a look!

Related posts