Skip to main content

​
Cloudflare Turnstile

Turnstile is the CAPTCHA on the login page. Its job is to stop bots enumerating email addresses through the magic-link and passkey endpoints, which — unlike a password form — must answer “check your inbox” whether or not an address exists. Scope: Global defaults only: the login page renders before any workspace is known. On KnoxCall Cloud it is already on; a self-hosted deployment creates its own widget.

​
1. In Cloudflare

  1. Cloudflare dashboard → Turnstile → Add widget.
  2. Hostnames: add every host that serves the login page — production, staging, and any custom domain. A widget with no hostname restriction can be embedded on anyone’s site.
  3. Widget mode: Managed (it decides when to show an interactive challenge).
  4. Create, then copy the Site key and the Secret key (both begin 0x4AAAAAAA…).
No API token and no account permissions are involved — Turnstile issues a key pair per widget.

​
2. Enter it in KnoxCall

Settings → Integrations → Global defaults → Cloudflare Turnstile → Configure: Both are required. Save credentials.

​
3. Verify

Open the login page in a private window: the widget renders only when the site key is stored. Request a magic link — a wrong secret key shows up here as a verification failure at sign-in, not at render.

​
Things that bite

  • Both keys, or nothing useful. With only the secret stored the widget never renders; with only the site key stored, verification is skipped.
  • Hostnames must include every login host, or the widget errors on the ones you forgot.
  • Verification is defence in depth. If the credential cannot be read at sign-in time, the login path continues rather than locking everyone out — a broken configuration degrades silently by design. Check the widget renders after any change.