> ## Documentation Index
> Fetch the complete documentation index at: https://turnkey-0e7c1f5b-renovate-npm-js-yaml-vulnerability.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Captcha

> Protect your auth flows from bots and abuse with Cloudflare Turnstile, configured in the Turnkey Dashboard.

Turnkey integrates [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) to add Captcha protection to authentication flows. When enabled, Turnstile presents a lightweight, user-friendly challenge that blocks automated abuse such as bots, credential-stuffing attacks, and signup spam, all without disrupting the experience for real users.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/turnkey-0e7c1f5b-renovate-npm-js-yaml-vulnerability/images/authentication/img/captcha-end-user-widget.png" alt="Cloudflare Turnstile challenge shown to end users during sign-up and OTP request" />
</Frame>

Captcha protection is enforced at the two entry points most vulnerable to abuse:

* **Requesting an email or SMS OTP**: captcha is required when the code is sent, covering both signup and login flows.
* **Signing up a new user**: captcha is required when creating a new sub-org via passkey, OAuth / social login, or external wallet.

Users are challenged once per flow. Passing the OTP challenge issues a one-time verification token that covers the code-entry and login steps that follow. Returning users signing in with a passkey, OAuth / social, or an external wallet are not challenged.

## Enabling Captcha

Captcha protection is configured at the organization level in the Turnkey Dashboard. Once enabled, it is automatically enforced for the protected flows.

<Warning>
  **SDK version requirement:** Captcha support is only available in `@turnkey/react-wallet-kit` v2.4.0 and above. Enabling captcha before updating your SDK will break authentication for your users.
</Warning>

<Note>
  **Automatic enforcement applies only to `@turnkey/react-wallet-kit` users.** The Turnstile widget is rendered and captcha tokens are attached for you, no code changes required.

  If you build your auth UI directly on `@turnkey/core` (plain JavaScript, TypeScript, Vue, Svelte, Angular, or a custom React UI), **you must integrate captcha yourself**: render the Turnstile widget, obtain a token, and pass it to the relevant SDK methods. See the [integration guides](#integration-guides) below for your setup.
</Note>

<Steps>
  <Step title="Open your Embedded Wallets Configuration">
    Log in to the [Turnkey Dashboard](https://app.turnkey.com) and navigate to **Configuration** for Embedded Wallets.
  </Step>

  <Step title="Find the Captcha toggle">
    Locate the **Captcha** setting in the Auth Proxy section.

    <Frame>
      <img src="https://mintcdn.com/turnkey-0e7c1f5b-renovate-npm-js-yaml-vulnerability/KY2_LjaqrIrypx3x/images/authentication/img/captcha-dashboard-toggle.png?fit=max&auto=format&n=KY2_LjaqrIrypx3x&q=85&s=4c226c95b7b617e1de0bfa7d46d72523" alt="Captcha protection toggle in the Turnkey Dashboard" width="1377" height="794" data-path="images/authentication/img/captcha-dashboard-toggle.png" />
    </Frame>
  </Step>

  <Step title="Enable Captcha">
    Toggle the setting **on** and save your changes. Captcha protection is now active for your organization.
  </Step>
</Steps>

<Note>
  Changes take effect immediately for all traffic. Confirm every client session is on a supported SDK version before enabling. Older SDKs will not be able to sign up new users or send OTP codes once captcha is turned on.
</Note>

## Integration guides

How much work Captcha takes depends on which SDK renders your auth UI:

| Your setup                                                                                                                        | What you do                                        | Guide                                                                                                       |
| --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| [`@turnkey/react-wallet-kit`](https://www.npmjs.com/package/@turnkey/react-wallet-kit)                                            | Nothing. The widget and tokens are handled for you | [Captcha (React)](/solutions/embedded-wallets/integration-guide/react/captcha)                              |
| React Native or Expo                                                                                                              | Render the widget in a WebView and pass tokens     | [Captcha (React Native)](/solutions/embedded-wallets/integration-guide/react-native/authentication/captcha) |
| [`@turnkey/core`](https://www.npmjs.com/package/@turnkey/core) directly (plain JavaScript, Vue, Svelte, Angular, custom React UI) | Render the widget and pass tokens                  | [Captcha with `@turnkey/core`](/solutions/embedded-wallets/integration-guide/typescript/captcha)            |

In every case the mechanics are the same: Turnstile runs its challenge when a user initiates a protected flow, issues a token on success, and Turnkey verifies that token before creating any auth activity. Requests that fail the challenge are rejected outright.

## Protected auth methods

| Auth flow                                          | Captcha enforced |
| -------------------------------------------------- | ---------------- |
| Email OTP: sending the code (signup & login)       | Yes              |
| Phone (SMS) OTP: sending the code (signup & login) | Yes              |
| New account signup via passkey                     | Yes              |
| New account signup via OAuth / social login        | Yes              |
| New account signup via external wallet             | Yes              |

## Related

* [Captcha (React)](/solutions/embedded-wallets/integration-guide/react/captcha)
* [Captcha (React Native)](/solutions/embedded-wallets/integration-guide/react-native/authentication/captcha)
* [Captcha with `@turnkey/core`](/solutions/embedded-wallets/integration-guide/typescript/captcha)
* [Auth Proxy](/features/authentication/auth-proxy)
* [Authentication overview](/features/authentication/overview)
* [React Wallet Kit: Getting started](/solutions/embedded-wallets/integration-guide/react/getting-started)