Cloudflare Turnstile Spin lets Claude Code, Cursor and Codex install and fix the widget for you
Cloudflare has released Turnstile Spin, a workflow that hands its AI-based CAPTCHA replacement to your coding agent so Claude Code, Cursor or Codex adds the widget on the frontend and wires up the server-side check in one pass.
Image: Cloudflare
Why it mattersA widget half-installed without server validation is a common Turnstile mistake that leaves the site open to bots, and Spin is Cloudflare using the same coding agents that shipped the buggy setup to also fix it.
Anyone who added Turnstile to a site in the last year and only remembered the frontend half has been serving a widget that stops nobody. Cloudflare today released Turnstile Spin, a setup workflow that hands the whole install to your coding agent, so Claude Code, Cursor or Codex places the widget on the frontend, calls Cloudflare's Siteverify from the backend, and closes the gap in one pass.
Cloudflare announced Turnstile Spin on 25 September 2026 in a post by Jules Lemee on its blog. Turnstile is Cloudflare's free client-side challenge, released in 2023 as a replacement for CAPTCHA that never shows a puzzle to a visitor. It processes about three billion verifications on a typical weekday, and Cloudflare says more than 23,000 accounts created a new Turnstile widget in one recent week.
The setup mistake Spin fixes
Turnstile has always been two steps. First the widget on the page issues a token when the visitor passes the challenge. Second the site's backend posts that token to Cloudflare's Siteverify API to confirm it, and gates the login, sign-up or form submission on the result. Skip the second step and the widget is decorative. The bot posts the form and the server does not check.
Cloudflare now watches Siteverify traffic for every widget. Any widget that has served traffic without a matching server call gets a "Fix with Spin" banner in the dashboard. The account owner clicks it, gives their agent access to the codebase, and the agent adds the missing server call while the widget keeps running.
How the agent does the work
Cloudflare says the agent runs on the developer's machine and makes the change inside the developer's own codebase. Application code is not sent to Cloudflare and the widget's shared secret is reused rather than rotated. Spin covers three cases: a fresh install with no CAPTCHA in place, a rescue of a widget that was left without a backend call, and a migration from another CAPTCHA provider where the agent detects the existing markers and proposes a substitution plan.
You can start Spin from the Cloudflare dashboard, from Wrangler, or by pasting the public skill URL into the agent directly. The change lands as a pull request the developer approves in the usual way.
Early use
Cloudflare says the workflow has been in the dashboard since July and has recorded more than 65,000 successful widget creations through Spin. The prompt that starts an agent from the dashboard has been copied more than 30,000 times. Both figures are Cloudflare's own.
The pitch behind Spin is that the tools that shipped the incomplete Turnstile install in the first place are now the ones that finish it. A founder who added a widget with a prompt to Cursor last month can send another prompt today and close the hole. Bot protection stops being a task the developer skipped because backend and frontend live in different files, and starts being a task the agent finishes on its own.
Source
- Turnstile Spin announcement, Cloudflare, 25 September 2026, by Jules Lemee.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
