TURNSTILE_FAILED
The publishable key requires a Cloudflare Turnstile token
The key was created with a Turnstile site key and secret, and the lookup carried no token or one Cloudflare did not confirm.
- http status
- 403
- credits
- Nothing is billed for a failed request.
What it means
A Turnstile-protected key needs a fresh turnstile_token with every lookup; tokens are single-use, so one cannot be reused across lookups. Nothing is billed for a refused lookup.
The form widget handles all of this when its script tag carries data-turnstile-site-key: it renders an invisible widget and fetches a token before each lookup.
What to do
Use the widget's data-turnstile-site-key attribute, or, with your own client, obtain a token from Turnstile before each request and send it as turnstile_token. A proxy in front of the endpoint must forward the token.
Example response
{
"success": false,
"error": {
"code": "TURNSTILE_FAILED",
"message": "This publishable key requires a valid Cloudflare Turnstile token with every lookup.",
"request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
}
}Every error carries the request_id also sent in the X-Request-Id header; quote it when writing to support.
Related
- ORIGIN_NOT_ALLOWED · the page's origin is not on the key's allowed list
- KEY_IP_NOT_ALLOWED · the key is used from an address outside its allowlist
- KEY_ACCOUNT_MISMATCH · the key belongs to an account its holder has left
- KEY_SCOPE_DENIED · the key lacks the scope this endpoint needs
- SANDBOX_ENDPOINT_NOT_ALLOWED · the sandbox key does not answer this endpoint
- SANDBOX_VALUE_NOT_ALLOWED · the sandbox key does not answer for that value
- EMAIL_NOT_VERIFIED · the account behind the key has not confirmed its email address
- All error codes
- Verdicts and the risk score
- API reference
markdown version: /docs/errors/TURNSTILE_FAILED.md