Turnstile is the Cloudflare challenge that mostly runs without user interaction, which makes it a favoured defence on sign-up and API front doors. It is also the cheapest type in our catalogue: one credit per token, the same as a simple text captcha.
Turnstile is a drop-in replacement for reCAPTCHA that is hosted by Cloudflare. It is common on Cloudflare-fronted sites, on login and registration forms, and increasingly on REST endpoints where the widget is invisible and only the token matters. Because Cloudflare also runs bot management, you will often see Turnstile on the same site as other Cloudflare protections.
Look for the div carrying the class cf-turnstile and read its data-sitekey attribute, or find the sitekey in the query string of the challenges.cloudflare.com iframe. The page URL must be the URL where the widget loads, because Cloudflare validates the token against the domain that requested it.
The response field on a classic form is named cf-turnstile-response. If the site calls turnstile.render with a callback, hand the token to that callback instead. For API style integrations the token is usually placed into a header or a JSON body field that the backend then verifies with Cloudflare.
One credit per token, which makes it the cheapest entry in the catalogue. Polling is free and refused submissions are not charged, so a Turnstile integration is cheap to validate. New accounts include 200 free solves.
curl -X POST https://fuckcaptcha.top/v1/token/turnstile \\
-H "Authorization: Basic $NSK_KEY" \\
-d '{"sitekey":"<sitekey>","url":"<page url>"}'Charged per solve: one credit for each recognition request, and polling for the result is free. Signing up includes 200 free solves.
No. Those are separate Cloudflare products with different mechanics. This endpoint targets the Turnstile widget and its token, identified by a sitekey that starts with 0x.
Usually not for the solve itself, but Cloudflare sites often also inspect the IP of the request that carries the token. If the site rejects a token that came back valid, route your own traffic through the same kind of address a normal visitor would use.
Turnstile is normally the fastest type we handle. Polling returns error 14 while the job is still running, and a fresh token should be requested close to the moment you submit it.
It is a lighter challenge with a simpler upstream flow, so it costs one credit rather than the twenty a reCAPTCHA token costs.
Yes. The extension handles Turnstile in place, which suits manual browsing, while the API suits scrapers and automated flows.