> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Turnstile

> Put Cloudflare Turnstile on the KnoxCall login page to stop bot-driven email enumeration — the widget to create, the hostnames to restrict it to, and the site key and secret key fields.

# Cloudflare Turnstile

Turnstile is the CAPTCHA on the login page. Its job is to stop bots enumerating email addresses through the magic-link and passkey endpoints, which — unlike a password form — must answer "check your inbox" whether or not an address exists.

**Scope: Global defaults** only: the login page renders before any workspace is known. On KnoxCall Cloud it is already on; a self-hosted deployment creates its own widget.

## 1. In Cloudflare

1. Cloudflare dashboard → **Turnstile → Add widget**.
2. **Hostnames**: add every host that serves the login page — production, staging, and any custom domain. A widget with no hostname restriction can be embedded on anyone's site.
3. **Widget mode: Managed** (it decides when to show an interactive challenge).
4. **Create**, then copy the **Site key** and the **Secret key** (both begin `0x4AAAAAAA…`).

No API token and no account permissions are involved — Turnstile issues a key pair per widget.

## 2. Enter it in KnoxCall

**Settings → Integrations → Global defaults → Cloudflare Turnstile** → *Configure*:

| Field          | Value                        |
| -------------- | ---------------------------- |
| **Secret key** | Server-side verification key |
| **Site key**   | Rendered into the login page |

Both are required. **Save credentials.**

## 3. Verify

Open the login page in a private window: the widget renders only when the site key is stored. Request a magic link — a wrong *secret* key shows up here as a verification failure at sign-in, not at render.

## Things that bite

* **Both keys, or nothing useful.** With only the secret stored the widget never renders; with only the site key stored, verification is skipped.
* **Hostnames must include every login host**, or the widget errors on the ones you forgot.
* **Verification is defence in depth.** If the credential cannot be read at sign-in time, the login path continues rather than locking everyone out — a broken configuration degrades silently by design. Check the widget renders after any change.

## Related

* [Threat model](/security/threat-model)