From manual integration to agent-driven setup
Cloudflare's Turnstile was introduced as a privacy-first client-side challenge that is free, runs on any site without proxying traffic through Cloudflare, and never asks visitors to solve a puzzle. Its integration has always followed a two-step pattern: render the widget on the frontend so Cloudflare can run client-side challenges and issue a token, then POST that token to the Siteverify API, which confirms whether the visitor passed and returns metadata you can act on — gating a login button, for instance.
Turnstile currently handles roughly three billion verifications on a typical weekday, and in one recent week more than 23,000 accounts created a widget in the Cloudflare dashboard. That growth exposed a gap: demand for straightforward bot protection extends well beyond people who write backend code daily. AI simultaneously lowers the barrier to building applications and widens the options for automated abuse.
Turnstile Spin is Cloudflare's answer — an agent-mediated, end-to-end implementation of Turnstile. It creates the widget, embeds it on your site, and wires Siteverify into the appropriate backend functions, mirroring what you would otherwise do by hand. It also repairs improperly installed widgets and handles migrations from other CAPTCHA providers. Spin can be launched from the Cloudflare dashboard, from Wrangler, or by pasting a public skill URL into your agent.
How Spin works with your coding agent
Spin converts the two-part Turnstile setup into a guided workflow run by your coding agent. You pick the location to protect; the agent locates the relevant frontend and backend code, presents a plan, and waits for approval before completing both halves of the integration. This lets someone without backend experience finish correctly, while an experienced developer avoids repetitive work and catches missed steps.
Application code is not sent to Cloudflare, and Cloudflare does not change it remotely. Your existing agent — Claude Code, Cursor, Codex, or another — applies the approved edits inside your codebase. The only new resource in your Cloudflare account is the Turnstile widget, and validation remains in your backend beside the logic that decides what happens after a challenge.
When you open the Turnstile page in your account, any widget that has served traffic without backend validation shows a "Fix with Spin" action, so you can check your own setup directly.
Three installation contexts
Fresh install
With no CAPTCHA present, the agent embeds the widget on the frontend and wires Siteverify into the backend from scratch.
Widget recovery
Cloudflare watches Siteverify calls per widget, and every widget lacking server-side validation receives a "Fix with Spin" banner in the dashboard. The agent reuses the same secret, adds the missing backend step, and leaves the widget serving traffic throughout.
Migration from an existing CAPTCHA
The agent identifies the existing markers, proposes a substitution plan, and applies it after your approval. The documentation's existing Turnstile migration paths continue to cover tool-specific details.
In practice these entry points are combined: you might start in the dashboard, paste the skill into your agent, and let Wrangler carry out the steps.
Adoption since launch
Spin saw use immediately after appearing in the dashboard. Since its July release, the dashboard has logged more than 65,000 successful Spin widget creations, and developers have copied the generated prompt over 30,000 times.
Getting started
Turnstile is free for everyone, so Spin can be used to deploy or repair widgets in minutes. A Cloudflare account can be created without further setup, and the documentation at developers.cloudflare.com/turnstile/spin covers additional details.
