Agents can now set up your website’s security with Turnstile Spin
Source
Jules Lemee
Author
Jules Lemee
Date
Key takeaways · AI-distilled
Turnstile setup has two halves: render the widget on the frontend to obtain a tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition →, then POST that token to the Siteverify API from the backend. Spin hands both halves to a coding AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition →, which proposes a plan and waits for approval before editing.
Cloudflare says Spin never sends application code to Cloudflare. The developer's own agent, such as Claude Code, Cursor or Codex, makes the approved edits locally; the only new Cloudflare resource is the widget, and validation stays in the app's backend.
Cloudflare monitors Siteverify calls per widget. A widget serving traffic with no server-side validation gets a "Fix with Spin" action, and the agent adds the missing backend check with the same secret while the widget keeps serving.
Spin also handles migration from other CAPTCHA providers: the agent detects existing markers, proposes a substitution plan and applies it after approval. It can be started from the dashboard, from Wrangler, or by pasting a public agent skillA reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.Full definition → URL into an agent.
Cloudflare reports more than 65,000 successful Spin widget creations and over 30,000 copies of its generated prompt since the July release. Turnstile overall processes about three billion verifications on a typical weekday, per the post.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
Why it matters
Turnstile Spin lets an agent handle both the frontend widget and backend Siteverify integration for Cloudflare's CAPTCHA-free bot protection, lowering the bar for builders who don't write backend code to fully deploy bot defense.
