Captcha

Bot protection that does not annoy your users

Every public-facing form — signup, login, forgot password — has Cloudflare Turnstile wired in. It runs invisibly for most visitors. No clicking fire hydrants. No typing blurry text. It just works in the background and blocks bots.

The integration is already done. The client-side widget loads on auth pages, passes a token with the form submission, and the server verifies it. If someone does not have JavaScript enabled or the widget fails to load, the form still works. Graceful degradation, not a hard block.

Setup

You need two things from Cloudflare: a site key and a secret key. Add your domain in the Turnstile dashboard, copy the keys into your environment variables, and you are done. Takes about two minutes.

The framework handles test keys automatically during development, so you do not need real credentials to work locally.