Test keys:
Public:
– 1x00000000000000000000AA – Always passes – visible
– 2x00000000000000000000AB – Always blocks – visible
– 1x00000000000000000000BB – Always passes – invisible
– 2x00000000000000000000BB – Always blocks – invisible
– 3x00000000000000000000FF – Forces an interactive challenge – visible
Secret:
– 1x0000000000000000000000000000000AA – Always passes
– 2x0000000000000000000000000000000AA – Always fails
– 3x0000000000000000000000000000000AA - Yields a "token already spent" error
sitekey Every widget has a sitekey. This sitekey is associated with the corresponding widget configuration and is created upon the widget creation. secretkey action A customer value that can be used to differentiate widgets under the same sitekey in analytics and which is returned upon validation. This can only contain up to 32 alphanumeric characters including _ and -. cData A customer payload that can be used to attach customer data to the challenge throughout its issuance and which is returned upon validation. This can only contain up to 255 alphanumeric characters including _ and -. callback A JavaScript callback invoked upon success of the challenge. The callback is passed a token that can be validated. error-callback A JavaScript callback invoked when there is an error (e.g. network error or the challenge failed). Refer to Client-side errors. execution Execution controls when to obtain the token of the widget and can be on render (default) or on execute. Refer to Execution Modes for more information. expired-callback A JavaScript callback invoked when the token expires and does not reset the widget. before-interactive-callback A JavaScript callback invoked before the challenge enters interactive mode. after-interactive-callback A JavaScript callback invoked when challenge has left interactive mode. unsupported-callback A JavaScript callback invoked when a given client/browser is not supported by Turnstile. theme The widget theme. Can take the following values: light, dark, auto. The default is auto, which respects the user preference. This can be forced to light or dark by setting the theme accordingly. language Language to display, must be either: auto (default) to use the language that the visitor has chosen, or an ISO 639-1 two-letter language code (e.g. en) or language and country code (e.g. en-US). Refer to the list of supported languages for more information. tabindex The tabindex of Turnstile's iframe for accessibility purposes. The default value is 0. timeout-callback A JavaScript callback invoked when the challenge presents an interactive challenge but was not solved within a given time. A callback will reset the widget to allow a visitor to solve the challenge again. response-field A boolean that controls if an input element with the response token is created, defaults to true. response-field-name Name of the input element, defaults to cf-turnstile-response. size The widget size. Can take the following values: normal, flexible, compact. retry Controls whether the widget should automatically retry to obtain a token if it did not succeed. The default is auto, which will retry automatically. This can be set to never to disable retry on failure. retry-interval When retry is set to auto, retry-interval controls the time between retry attempts in milliseconds. Value must be a positive integer less than 900000, defaults to 8000. refresh-expired Automatically refreshes the token when it expires. Can take auto, manual, or never, defaults to auto. refresh-timeout Controls whether the widget should automatically refresh upon entering an interactive challenge and observing a timeout. Can take auto (automatically refreshes upon encountering an interactive timeout), manual (prompts the visitor to manually refresh) or never (will show a timeout), defaults to auto. Only applies to widgets of mode managed. appearance Appearance controls when the widget is visible. It can be always (default), execute, or interaction-only. Refer to Appearance modes for more information. feedback-enabled Allows Cloudflare to gather visitor feedback upon widget failure. It can be true (default) or false.