> ## Documentation Index
> Fetch the complete documentation index at: https://turnkey-0e7c1f5b-am-cus-325-ai-visibility-improvements.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Turnkey is wallet infrastructure: create and manage crypto wallets, sign transactions, and enforce policy-based access controls. Best-fit uses: embedded consumer wallets (email/passkey/social auth, no seed phrases), automated onchain operations with server-side wallets, AI agent wallets with policy-scoped signing, enterprise key management, and verifiable off-chain workloads on Turnkey Verifiable Cloud (TVC).
> Every API call is a JSON POST to https://api.turnkey.com signed with a P-256 API key; create an organization and key self-serve at https://app.turnkey.com.
> Key Turnkey developer resources: API reference (https://docs.turnkey.com/api-reference/overview/intro.md), OpenAPI spec (https://docs.turnkey.com/public_api.swagger.json), authentication (https://docs.turnkey.com/features/authentication/overview.md), webhooks (https://docs.turnkey.com/features/webhooks/overview.md), MCP server for docs search (https://docs.turnkey.com/mcp), agent skills (https://docs.turnkey.com/get-started/ai-skills.md), CLI (https://docs.turnkey.com/sdks/cli.md), SDK reference (https://docs.turnkey.com/sdks/introduction.md), full docs content (https://docs.turnkey.com/llms-full.txt).

# Captcha

> Cloudflare Turnstile captcha protection in @turnkey/react-wallet-kit, handled automatically once enabled in the Dashboard.

## Overview

<Warning>
  Captcha support requires `@turnkey/react-wallet-kit` version **2.3.0** or later and `@turnkey/core` version **2.4.0** or later. Earlier versions have no way to render the Turnstile widget or attach a captcha token to a request.
</Warning>

[Captcha protection](/features/authentication/captcha) is enabled once, at the organization level, in the Turnkey Dashboard. Once it's on, **every signup and every OTP send** must carry a Cloudflare Turnstile token or the Auth Proxy rejects it.

`@turnkey/react-wallet-kit` renders the Turnstile widget and attaches tokens for you, so there is no integration work to do. Enable the toggle in the Dashboard and your existing auth code keeps working.

```tsx theme={"system"}
// No changes needed: Captcha is handled automatically by the SDK
import { useTurnkey } from "@turnkey/react-wallet-kit";

function LoginButton() {
  const { handleLogin } = useTurnkey();
  return <button onClick={handleLogin}>Login / Sign Up</button>;
}
```

## How it works

1. When a user initiates a protected flow (sending an OTP or signing up for a new account), the Turnstile widget renders inside the auth UI.
2. Turnstile performs its challenge in the background. For most legitimate users, this is invisible or requires a single click.
3. On success, Turnstile issues a token that is passed along with the request to Turnkey's backend for verification.
4. Requests that fail the Captcha challenge are rejected before any auth activity is created.

The widget runs in Cloudflare's **Managed** mode with `appearance: "interaction-only"`, so it stays hidden for the overwhelming majority of users and only appears when Cloudflare asks for interaction. A short "Let us know you're human" prompt is shown just before that happens.

Because a token may not have arrived yet at the moment the user submits, the wallet kit polls for up to 5 seconds before giving up and sending the request without one.

<Note>
  OAuth signups are challenged before the user leaves your app for the provider. The wallet kit encodes the captcha token into the OAuth `state` parameter and reads it back on return, for both its popup and redirect flows.
</Note>

## Building your own UI

If you're building auth screens directly on `@turnkey/core` rather than using the wallet kit's UI, you render the widget and attach tokens yourself. See [Captcha with `@turnkey/core`](/solutions/embedded-wallets/integration-guide/typescript/captcha).

## Related

* [Captcha protection](/features/authentication/captcha)
* [Authentication](/solutions/embedded-wallets/integration-guide/react/auth)
* [Captcha with `@turnkey/core`](/solutions/embedded-wallets/integration-guide/typescript/captcha)
* [Auth Proxy](/features/authentication/auth-proxy)