User Guide
Captcha Configuration
Configure Cloudflare Turnstile on sign-in and sign-up
TinyShip uses Cloudflare Turnstile to block scripted sign-ups and sign-ins.
Related pages
| Page | Path | Description |
|---|---|---|
| Sign in | /signin | Turnstile when captcha is enabled |
| Sign up | /signup | Turnstile when captcha is enabled |
Configuration
config/captcha.ts ships with captcha enabled. The provider id is 'cloudflare-turnstile'. Keys are read from the cloudflare getters.
// config/captcha.ts
import { getEnvForService } from './utils';
export const captchaConfig = {
enabled: true,
defaultProvider: 'cloudflare-turnstile',
cloudflare: {
get secretKey() {
// Development always uses Cloudflare's pass-all test secret.
if (process.env.NODE_ENV === 'development') {
return '1x0000000000000000000000000000000AA';
}
return getEnvForService('TURNSTILE_SECRET_KEY', 'Cloudflare Turnstile');
},
get siteKey() {
if (process.env.NODE_ENV === 'development') {
return '1x00000000000000000000AA';
}
const publicKey = process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY;
if (publicKey) return publicKey;
return getEnvForService('TURNSTILE_SITE_KEY', 'Cloudflare Turnstile');
},
},
}enabledturns verification on or off. Set it tofalseto skip Turnstile.defaultProvideris'cloudflare-turnstile'.cloudflare.secretKeyis the server secret (Better Auth).cloudflare.siteKeyis the public site key. In production it prefersNEXT_PUBLIC_TURNSTILE_SITE_KEY, thenTURNSTILE_SITE_KEY.
Environment variables
# Cloudflare Turnstile
TURNSTILE_SECRET_KEY="your-turnstile-secret-key"
NEXT_PUBLIC_TURNSTILE_SITE_KEY="your-turnstile-site-key"In development (NODE_ENV=development) those variables are not used. The getters return Cloudflare's always-pass test keys: site key 1x00000000000000000000AA and secret 1x0000000000000000000000000000000AA. Production needs the real keys from your Turnstile widget.
Create a Turnstile widget
- Open the Cloudflare dashboard.
- Go to Turnstile.
- Add a site (or open an existing widget).
- Copy the site key and the secret key into
.env.