Cloudflare Launches Turnstile Spin for Agent-Mediated Security Setup

Cloudflare Launches Turnstile Spin for Agent-Mediated Security Setup Cloudflare has introduced Turnstile Spin, an agent-assisted implementation tool designed to automate and fix end-to-end setups of its CAPTCHA alternative, Turnstile, directly within user codebases. Turnstile handles roughly three billion verifications each weekday, but traditionally required manual frontend and backend coding. Turnstile Spin integrates with AI coding agents like Claude Code, Cursor, or Codex to configure widgets and backend Siteverify validation without sending source code to Cloudflare. The tool handles greenfield deployments, corrects setups lacking server-side verification via a dashboard prompt, and migrates existing CAPTCHAs. Since its July release, Turnstile Spin has seen over 65,000 widget creations and more than 30,000 prompt copies. Simplifying Dual-Sided Implementation Standard Turnstile setup requires adding a frontend widget and wiring server-side validation via the Siteverify API. Turnstile Spin automates this two-step process for developers and AI builders alike. Working through tools like Wrangler, the Cloudflare dashboard, or public agent skills, coding agents scan the codebase, propose an integration plan, and apply both frontend and backend changes upon user approval. Local Execution and Use Cases Spin executes locally inside the user's development environment, ensuring application code is not transmitted to Cloudflare. It adapts across three primary contexts: configuring Turnstile from scratch, migrating away from other CAPTCHA providers, and remediating improperly configured widgets that lack backend verification through a dedicated 'Fix with Spin' dashboard option. Adoption and Development Turnstile Spin addresses security risks arising from rapid, prompt-driven application creation. Since launching in July, the feature has recorded over 65,000 widget creations. Turnstile remains free to use and operates without routing traffic through Cloudflare proxies or presenting visual puzzles to site visitors.

Cloudflare 推出 Turnstile Spin，支持通过 AI 智能体端到端部署安全验证 Cloudflare 宣布推出 Turnstile Spin，这是一种由 AI 智能体引导的 Turnstile 端到端配置方案，旨在简化传统的前后端两步式验证部署流程，让开发者和 AI 构建者能快速接入或修复防机器人验证。 Turnstile 在工作日通常处理约 30 亿次验证，但其原有的两步式前后端手动配置对非后端开发者存在门槛。 Turnstile Spin 可配合 Claude Code、Cursor 等智能体，自动扫描代码库并完成前端组件渲染和后端 Siteverify 验证接入。 应用代码无需上传至 Cloudflare，所有修改仅在用户本地代码库经确认后执行。 Spin 支持全新配置、修补遗漏后端验证的组件，以及从其他 CAPTCHA 服务迁移等三种场景。 降低部署门槛与适应 AI 开发范式 Turnstile 作为免费且无须解题的客户端人机验证工具，原有流程需要开发者在前端渲染微件并在后端调用 Siteverify API 校验令牌。随着 AI 编码工具普及，大量非专业后端开发者加入应用构建，传统手动安全配置容易因遗漏后端验证而失效。Turnstile Spin 引入了原生 AI 智能体工作流支持，帮助各类开发者在本地更轻松、正确地部署防护。 运作机制与本地代码隐私保障 Turnstile Spin 将原本分离的步骤转化为智能体引导流程。用户选定防护位置后，本地使用的智能体（如 Cursor、Claude Code 等）会定位相关代码并提出修改计划，获得用户批准后同步完成前后端集成。整个过程不会将代码上传给 Cloudflare 或进行远程修改，验证逻辑与决策始终留在用户后端的应用程序内。 三种适配场景与启动方式 Spin 能够自适应三种代码库上下文：从零开始接入微件与后端接口；针对控制台标记有流量但未接入后端验证的微件提供一键修复；以及识别并替换现有其他 CAPTCHA 服务。用户可以通过 Cloudflare 控制台、Wrangler 命令行工具或向智能体输入公共技能 URL 来启动该流程。

In 2023, Cloudflare declared itself [free from CAPTCHAs](https://blog.cloudflare.com/turnstile-ga/) with the launch of Turnstile, our privacy-first client-side challenge. Turnstile is free to use, works on any site (no need to proxy traffic through Cloudflare), and never asks a visitor to solve a puzzle. Now, we are launching Turnstile Spin, an agent-mediated end-to-end implementation of Turnstile. Initially built with developers in mind, Turnstile requires a basic two-step implementation and understanding of frontend and backend development. First, you modify your frontend code to render the Turnstile widget; this allows Cloudflare to run the client-side challenges and issue a token. Second, you POST the token to our Siteverify API, which verifies the token and returns metadata about whether the visitor passed or failed the challenge. You can then act on this decision, like gating the login button until the visitor successfully solves a Turnstile challenge. Turnstile now processes about three billion verifications on a typical weekday, and in one recent week more than 23,000 accounts created a new widget in the Cloudflare dashboard. This rapid adoption pushed us to evaluate how we can help users achieve full Turnstile validation seamlessly. Turnstile was built for developers, but demand for simple bot protection reaches far beyond people who write backend code every day. AI raises the stakes: it helps more people build applications, while giving attackers more ways to automate abuse. We wanted the same technology to make Turnstile easier to install correctly. Turnstile Spin is our implementation of this new capability. You can use it to create the widget, embed it on your site, and embed Siteverify to relevant functions in your backend, just as you would manually. Spin also fixes improperly installed widgets and handles migrations from other CAPTCHA providers. You can start it from your [Cloudflare dashboard](https://dash.cloudflare.com/sign-up?to=/:account/turnstile), from [Wrangler](https://developers.cloudflare.com/workers/wrangler/), or by pasting a [public skill](https://github.com/cloudflare/skills/tree/main/skills/turnstile-spin) URL into your agent. When we first built Turnstile, web development followed a standard engineering pattern: developers wrote client-side interfaces and backend logic by hand. Turnstile’s setup naturally reflected that two-step workflow. Today, the way web applications are built has fundamentally shifted. AI coding agents now enable anyone, from experienced engineers to first-time creators, to spin up functional sites in seconds. However, security workflows designed for manual development don't always align with prompt-driven building. To make Turnstile as effortless for AI builders as it has been for traditional web developers, we are introducing native support for AI agent workflows. Spin is designed to do that automatically. To check your own setup, open the Turnstile page in your account. If a widget has served traffic without backend validation, you will see a "Fix with Spin" action. Turnstile Spin turns a two-part setup into a guided workflow with your coding agent. You choose where you want protection, and the agent finds the relevant frontend and backend code, proposes a plan, and waits for your approval. It then completes both sides of the integration together. Someone without backend experience can finish the setup correctly, while an experienced developer can skip repetitive work and catch missing steps. Spin does not send your application code to Cloudflare or ask Cloudflare to change it remotely. The agent you already use, whether Claude Code, Cursor, Codex, or something else, makes the approved changes inside your codebase. The only new resource in your Cloudflare account is the Turnstile widget. Validation stays in your backend, next to the application logic that decides what happens after a challenge. Spin can adapt to whichever of three contexts it finds in your codebase: No CAPTCHA in place. The agent embeds the widget on your frontend and wires Siteverify into your backend from scratch. Cloudflare monitors Siteverify calls for each widget, and any widget with no server-side validation gets a "Fix with Spin" banner in your dashboard. The agent uses the same secret and adds the missing step to your backend, while the widget keeps serving traffic. This flow pre-empts the kind of support tickets people used to send about their Turnstile setups. The agent detects the existing markers, proposes a substitution plan, and applies it after you approve. Existing Turnstile migration paths in the docs still cover the tool-specific details. You can start Spin from the [dashboard](https://dash.cloudflare.com/sign-up?to=/:account/turnstile), [Cloudflare Wrangler](https://developers.cloudflare.com/workers/wrangler/), or your agent directly through [our skill](https://github.com/cloudflare/skills/tree/main/skills/turnstile-spin). Typically, you'll use a combination of the three, by starting from the dash and pasting the skill into your agent, which will use Wrangler to facilitate the steps for you. People began using Spin as soon as it reached the dashboard. Since its release in July, the dashboard has recorded more than 65,000 successful Spin widget creations, and developers have copied the generated prompt more than 30,000 times. This rapid adoption has demonstrated that bringing Turnstile directly into AI workflows fills a real, immediate need for builders. Those results also reflect the biggest lesson I learned while building Spin as an intern: an intuitive idea still needs time, feedback, and repeated simplification. Early in my internship, Bryan Becker advised me to share work before it felt finished, and Marina Elmore kept pushing me back to the customer's question whenever I overcomplicated the answer. I followed that advice by showing rough versions early, testing them with the team, and cutting as many steps as possible in the path of simpler security for our customer. Turnstile is free for everyone, so try out Spin to deploy or fix Turnstile widgets in minutes. If you don’t have a Cloudflare account, you can create one with no further setup. Check out the [docs](http://developers.cloudflare.com/turnstile/spin) for more details, and don’t hesitate to send us feedback.