Cloudflare launches Turnstile Spin to automate bot protection setup for AI coding agents

Cloudflare has launched Turnstile Spin, an agent-mediated implementation of its privacy-first bot protection service, Turnstile. Designed for the era of AI coding agents, Spin automates the traditionally manual two-step process of embedding the client-side widget and integrating the backend Siteverify API. This allows users, including those without backend experience, to deploy or fix security measures using natural language prompts within their existing coding environments.

How Turnstile Spin Works

Spin integrates with AI coding agents like Claude Code, Cursor, and Codex to handle three primary scenarios:

• Fresh install: The agent embeds the Turnstile widget on the frontend and wires the Siteverify API into the backend from scratch.
• Widget recovery: If Cloudflare detects a widget serving traffic without backend validation, Spin identifies the missing step and adds the necessary code to the backend while the widget remains active.
• Migration: The agent detects existing CAPTCHA markers, proposes a substitution plan, and applies the changes after user approval.

Users can initiate Spin via the Cloudflare dashboard, Wrangler, or by pasting a public skill URL directly into their agent. Crucially, Spin does not send application code to Cloudflare; the local agent makes approved changes directly in the codebase, ensuring validation logic stays within the user's backend infrastructure.

Adoption and Context

Turnstile currently processes approximately three billion verifications on a typical weekday. The shift toward AI-assisted development has increased both the volume of new applications and the sophistication of automated abuse, prompting Cloudflare to simplify security integration. Since its release in July, the dashboard has recorded more than 65,000 successful Spin widget creations, with developers copying the generated prompts over 30,000 times.