No staged screenshot and no mock. We run two genuine Cloudflare Turnstile widgets on sitekeys we own — one managed, one invisible — each declared in the markup of its own page. Solve one yourself, or point a solve call at either URL and paste the token back below. The verdict is Cloudflare's, checked server-side against siteverify with our secret key.
The interactive end of Turnstile. Cloudflare decides, per visitor, whether the checkbox resolves on its own or asks for a click — so a solver has to be ready for either.
Open the managed challenge →No widget is drawn at all. The challenge runs on page load and the token lands in a hidden field, which is why a page can look completely clear and still be gated.
Open the invisible challenge →A document can only honestly advertise one sitekey. Two widgets on one URL means two challenge flows running against Cloudflare from that one address, and a token handed back from it names neither — yet the tokens are not interchangeable, because each sitekey has its own secret and the wrong one reads as a bad token. One widget per URL makes the answer to "which widget issued this?" the address you sent the job to. Cloudflare's third mode, non-interactive, sits between them; the widget modes glossary covers all three.
Each page is a stable test target: its sitekey and URL don't move, and both are printed on the page in the exact shape /v1/solve wants them. Send the pair, take the token off the response, and paste it into the box below — telling us which page it came from — to watch Cloudflare accept it. Full reference in the docs.
This page holds no widget of its own. Take a token off either challenge page and check it here.
Your token goes to siteverify with that widget's secret key. What comes back is printed here unedited.
Nothing verified yet. Hand us a token and hit verify — the answer below comes from Cloudflare, not from us.
First 1,000 solves are free. No card, no call — a key and one POST.
// this demo verifies tokens against our own sitekeys only — see acceptable use