Cloudflare Turnstile Siteverify API
50
AI ReadinessFoundational (D+)50/100
Official vendor OpenAPI document · agent-readySecurityThreat DetectionapiKey1 EndpointsREST
For Agents
Verify Cloudflare Turnstile tokens server-side to confirm visitors passed the invisible challenge. Returns pass/fail status with error codes for bot detection without visual CAPTCHAs.
Use for: I need to verify a Turnstile token from my frontend form submission, Check whether a user passed the Cloudflare challenge before processing their request, Validate that a Turnstile response token has not been replayed or expired, Get the hostname and action from a verified Turnstile token
Not supported: Does not handle DNS management, CDN configuration, WAF rules, or Workers deployment - use for Turnstile challenge token verification only.
Validate Turnstile challenge tokens server-side to verify that visitors are genuine humans without presenting visual CAPTCHAs. The single siteverify endpoint accepts a token from the client-side widget along with your secret key and returns a pass/fail verdict with challenge metadata.
Install Jentic One Beta
Connect the Cloudflare Turnstile Siteverify API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cloudflare Turnstile Siteverify API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcloudflare.com%2Fcloudflare" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcloudflare.com%2Fcloudflare" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Cloudflare Turnstile Siteverify API.
Validate Turnstile challenge tokens to confirm a visitor completed the invisible verification widget
Detect automated traffic by checking token validity, expiration, and replay attempts
Retrieve challenge metadata including hostname, timestamp, and action tags from verified tokens
Differentiate between managed, non-interactive, and invisible challenge modes via response fields
Identify specific failure reasons through structured error codes when token validation fails
Use Cases
Patterns agents use Cloudflare Turnstile Siteverify API for, with concrete tasks.
★ AI Agent Bot Detection Verification
AI agents use the Turnstile Siteverify API through Jentic to validate challenge tokens before processing form submissions or API requests. An agent receives a Turnstile token from a client-side widget, sends it to the siteverify endpoint with the site secret key, and checks the success field. This prevents automated abuse while maintaining a frictionless user experience without visual puzzles.
Send a POST request to /siteverify with the Turnstile response token and secret key, then check if the success field is true and the hostname matches the expected domain
Form Submission Protection
Protect web forms against automated submissions by requiring Turnstile token validation before processing user input. The siteverify endpoint confirms that the token was generated by a genuine browser interaction on the correct hostname. Failed verifications return error codes identifying whether the token was missing, expired, already redeemed, or associated with a different site.
Validate a Turnstile token from a contact form submission, verify the hostname matches 'example.com', and return the error codes if validation fails
Token Replay Prevention
Prevent replay attacks by verifying that each Turnstile token is only used once. The siteverify endpoint tracks previously validated tokens and rejects duplicate submissions with a specific error code. This ensures that captured tokens cannot be reused by attackers to bypass bot detection, providing defense-in-depth for sensitive operations like account creation and payment processing.
Submit the same Turnstile token twice to /siteverify and verify that the second request returns success: false with a timeout-or-duplicate error code
Key Endpoints
1 endpoints — validate turnstile challenge tokens server-side to verify that visitors are genuine humans without presenting visual captchas.
METHOD
PATH
DESCRIPTION
POST
/siteverify
Validate a Turnstile challenge response token
POST
/siteverify
Validate a Turnstile challenge response token
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
C
Cloudflare Turnstile Siteverify API
- Foundational (D+)50/100
100
Foundational Compliance64
Developer Experience & Jentic Compatibility53
AI-Readiness & Agent Experience94
Agent Usability15
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
100
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A+Signals: 4
99%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
100%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
64
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: BSignals: 4
4%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
50%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
53
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: CSignals: 4
63%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
50%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
15
Security
Trust, risk posture, and security compliance.
Grade: FSignals: 1
15%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Cloudflare Turnstile Siteverify API by hand means passing your site secret as a query field alongside the response token and posting to challenges.cloudflare.com/turnstile/v0 yourself. Through Jentic you install once, import the Turnstile Siteverify API from the API Directory, store the secret once, and your agent calls it.
Permission scoping
Turnstile exposes a single siteverify operation with the token in the request, so scope the agent to that one operation: it can verify a challenge token and nothing more. You choose that set, so no other call is in reach unless you add it.
Credential isolation
Your Turnstile secret key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'verify a bot detection token', and Jentic returns the Turnstile siteverify operation with its request schema, including the secret and response token fields, so the agent calls it without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Cloudflare Turnstile Siteverify API through Jentic.
What response fields does the Turnstile siteverify endpoint return?
The response includes: success (boolean pass/fail verdict), challenge_ts (ISO timestamp of when the challenge was solved), hostname (the domain where the widget was rendered), error-codes (array of error identifiers if validation failed), and action (the action name if configured in the widget). These fields enable both validation and audit logging.
What authentication does the Cloudflare Turnstile Siteverify API use?
The siteverify endpoint requires your Turnstile site secret key passed as the 'secret' parameter in the POST body. This is a per-site key generated in the Cloudflare dashboard, separate from your global API key. Through Jentic, the secret key is stored encrypted in your Jentic One instance so agents never handle it directly.
Can I verify a Turnstile token through the API without the client-side widget?
No. The siteverify endpoint validates tokens that are generated by the Turnstile client-side widget embedded in your HTML page. The widget runs a challenge in the visitor's browser and produces a token. Your server then sends this token to /siteverify for validation. Without a client-side token, there is nothing to verify.
What error codes does the Turnstile siteverify endpoint return?
Common error codes include: missing-input-secret (secret key not provided), invalid-input-secret (secret key is wrong), missing-input-response (token not provided), invalid-input-response (token is malformed), timeout-or-duplicate (token has expired or was already used), and internal-error (Cloudflare service issue). The error-codes array in the response lists all applicable errors.
How do I validate a Turnstile token through Jentic?
Search Jentic for 'verify a Turnstile token'. The agent receives the POST /siteverify schema requiring the secret key and response token fields. Send the token received from your frontend form, and check the success boolean in the response. The hostname and challenge_ts fields confirm where and when the challenge was completed.
Does the Turnstile siteverify endpoint have rate limits?
Cloudflare does not publish explicit rate limits for the siteverify endpoint, but it is designed for per-form-submission validation rather than bulk querying. Each token can only be verified once - subsequent attempts for the same token return a timeout-or-duplicate error. For high-traffic sites, validate only on form submissions, not on page loads.
Can I limit what my agent is allowed to do with the Cloudflare Turnstile Siteverify API?
Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Turnstile exposes only the single POST /siteverify operation, so you scope the agent to that one call: it can validate a challenge response token and read back the success verdict, hostname, timestamp, and error codes, and nothing more. Your Turnstile site secret is injected at execution time from your own instance, so the agent verifies tokens without ever handling the key, and no other action is reachable unless you grant it.
GET STARTED