Turnstile Spin helps coding agents install both halves of bot checks

Cloudflare launched Turnstile Spin on 25 September to help coding agents configure its bot-verification service. Turnstile needs a frontend widget that obtains a token and a backend request to the Siteverify API that validates it. Adding only the widget leaves the application without that server-side check.

Spin is designed to locate the relevant code, propose a plan and have the developer’s agent make approved changes. It supports fresh installations, repairs of incomplete setups and migrations from other CAPTCHA providers. Cloudflare says application code is not sent to it for remote editing. Validation remains in the backend, beside the application logic deciding what a passed or failed result permits. The launch concerns installing that flow correctly, rather than treating a visible challenge as complete protection.