Cloudflare Turnstile Siteverify API

What authentication does the Cloudflare Turnstile Siteverify API use?

The siteverify endpoint requires your Turnstile site secret key passed as the 'secret' parameter in the POST body. This is a per-site key generated in the Cloudflare dashboard, separate from your global API key. Through Jentic, the secret key is stored encrypted in your Jentic One instance so agents never handle it directly.

Can I verify a Turnstile token through the API without the client-side widget?

No. The siteverify endpoint validates tokens that are generated by the Turnstile client-side widget embedded in your HTML page. The widget runs a challenge in the visitor's browser and produces a token. Your server then sends this token to /siteverify for validation. Without a client-side token, there is nothing to verify.

What error codes does the Turnstile siteverify endpoint return?

Common error codes include: missing-input-secret (secret key not provided), invalid-input-secret (secret key is wrong), missing-input-response (token not provided), invalid-input-response (token is malformed), timeout-or-duplicate (token has expired or was already used), and internal-error (Cloudflare service issue). The error-codes array in the response lists all applicable errors.

How do I validate a Turnstile token through Jentic?

Search Jentic for 'verify a Turnstile token'. The agent receives the POST /siteverify schema requiring the secret key and response token fields. Send the token received from your frontend form, and check the success boolean in the response. The hostname and challenge_ts fields confirm where and when the challenge was completed.

Does the Turnstile siteverify endpoint have rate limits?

Cloudflare does not publish explicit rate limits for the siteverify endpoint, but it is designed for per-form-submission validation rather than bulk querying. Each token can only be verified once - subsequent attempts for the same token return a timeout-or-duplicate error. For high-traffic sites, validate only on form submissions, not on page loads.

Can I limit what my agent is allowed to do with the Cloudflare Turnstile Siteverify API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Turnstile exposes only the single POST /siteverify operation, so you scope the agent to that one call: it can validate a challenge response token and read back the success verdict, hostname, timestamp, and error codes, and nothing more. Your Turnstile site secret is injected at execution time from your own instance, so the agent verifies tokens without ever handling the key, and no other action is reachable unless you grant it.