The problem we are solving
We have mobile apps calling APIs through Cloudflare. The APIs are seeing automated traffic from headless browsers, scripted clients, and bot-like agents. The business requirement is clear: reduce abuse without showing users a traditional CAPTCHA.
Cloudflare Turnstile can help, but the implementation has to be designed carefully.
The mistake is to treat Turnstile as something we send with every API request. That is not how Turnstile should be used. Turnstile produces short-lived, single-use tokens that must be validated by the backend through Cloudflare Siteverify. After validation, the application should issue its own short-lived clearance token and use that token for selected protected API calls.
The target design is:
