> ## Documentation Index
> Fetch the complete documentation index at: https://turnkey-0e7c1f5b-ethan-captcha-protection.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Captcha Protection

> Overview of captcha support across Turnkey SDKs, including supported versions and setup guides.

## Overview

Turnkey supports [Cloudflare Turnstile](https://developers.cloudflare.com/turnstile/) captcha protection to help prevent automated abuse of authentication endpoints. When enabled, captcha tokens are required for Signup and InitOtp requests made through the Auth Proxy.

Captcha is enabled per-organization in the [Turnkey Dashboard](https://app.turnkey.com) under the **Wallet Kit** settings page.

<Warning>
  Once captcha is enabled in the dashboard, **all** Signup and InitOtp requests will require valid captcha tokens. Make sure your application is updated to a supported SDK version and has captcha integrated **before** enabling this setting.
</Warning>

## Supported SDKs

<CardGroup>
  <Card title="React Wallet Kit" href="/sdks/react/captcha" icon="react" iconType="brands" horizontal>
    `@turnkey/react-wallet-kit` — **v.x.x.x+**
  </Card>

  <Card title="Core SDK" href="/sdks/typescript-frontend/captcha" icon="js" iconType="brands" horizontal>
    `@turnkey/core` — **v.x.x.x+**
  </Card>
</CardGroup>

## How It Works

1. **Enable captcha** in the Turnkey Dashboard under Wallet Kit settings.
2. The SDK automatically receives a `turnstileSiteKey` from the Auth Proxy via the `getWalletKitClientParams` request.
3. Your application renders a Cloudflare Turnstile widget that generates captcha tokens.
4. Captcha tokens are attached to Signup and InitOtp requests as an `X-Captcha-Token` header.

For detailed integration guides, see the SDK-specific pages linked above.

## Recommended Rollout

<Steps>
  <Step title="Update your SDK">
    Upgrade to a captcha-supported version of the SDK (see table above).
  </Step>

  <Step title="Integrate captcha in your app">
    Follow the setup guide for your SDK. The captcha widget will idle silently in the background until captcha is enabled — there is no impact to your users.
  </Step>

  <Step title="Enable captcha in the dashboard">
    Once your app is deployed with captcha support, toggle the **Captcha** option in the Turnkey Dashboard. From this point on, all Signup and InitOtp requests will require valid tokens.
  </Step>
</Steps>

<Note>
  You can verify that your app is ready by checking for the presence of `turnstileSiteKey` in the SDK config. If the key is present, captcha is enabled and your app should be providing tokens with each request.
</Note>