Cloudflare Turnstile on hosted authentication

Hosted authentication is a public surface. Bots hit sign-up, password reset, and one-time-code endpoints the same way they hit any login form. Authdog already supported Google reCAPTCHA as an environment add-on. Environments can now require Cloudflare Turnstile on the same hosted flows.

This is the longer note behind the September 7 changelog entry.

Why a second provider

reCAPTCHA and Turnstile solve the same problem with different products. Some teams already run Cloudflare in front of the app and want one challenge vendor. Others prefer Turnstile's privacy-oriented widget over image puzzles. Authdog treats them as sibling add-ons so the choice is per environment, not a platform-wide switch.

Pick one. If both add-ons cover the same action, reCAPTCHA is used.

Bot protection filters traffic before it authenticates. It complements Lidar detections and rate limiting; it does not replace them.

How it works

Turnstile is stored as the cloudflare_turnstile provider on environment_addons. Configuration is a site key, a widget mode, and an optional list of protected actions. The secret key is stored separately.

The same action names apply to both providers:

• signin, signup, waitlist, password_reset — can render a visible widget
• magic_link, otp_verify, otp_resend, mfa_verify — invisible only

Widget mode decides what the hosted page can show:

• Managed and non-interactive render a widget on sign-in, sign-up, waitlist, and password reset, similar to reCAPTCHA v2
• Invisible can cover every hosted flow, similar to reCAPTCHA v3

Selecting no actions protects all of them. An enabled add-on defaults to its broadest coverage.

The hosted pages resolve a single captcha provider, then render the widget and client script. Existing form JavaScript still calls window.__authdogRecaptcha.getToken; Turnstile tokens travel through the same field so API handlers did not need a second client contract.

Server verification talks to challenges.cloudflare.com/turnstile/v0/siteverify. The existing enforceRecaptcha / enforceRecaptchaV3 helpers also verify Turnstile, so passwordless and MFA handlers pick up the new provider without a per-route rewrite.

Set it up

In the Authdog console, open Authentication > Add-ons and choose Cloudflare Turnstile:

1. Create a widget in the Cloudflare dashboard and copy the site key.
2. Paste the site key and secret into Authdog. Match widget mode to the Cloudflare widget.
3. Optionally restrict protected actions. Leave the list empty to cover every hosted flow the mode supports.
4. Save, then exercise sign-in (and password reset if you enabled it) on the hosted Account Portal.

A visible widget configured only for invisible-only actions does nothing. Those flows need invisible mode, or reCAPTCHA v3.

Trust boundaries

Authdog trusts the Turnstile siteverify response for the configured secret. Store the secret only in Authdog. A failed or missing challenge fails closed when the add-on is enabled for that action.

Self-hosted deployments that cannot reach Cloudflare should keep using reCAPTCHA. Turnstile is a Cloudflare-hosted challenge.

Try it

Setup details live in Bot protection. The original release note is in the changelog.