# Turnstile # Widgets ## List Turnstile Widgets `turnstile.widgets.list(WidgetListParams**kwargs) -> SyncV4PagePaginationArray[WidgetListResponse]` **get** `/accounts/{account_id}/challenges/widgets` Lists all turnstile widgets of an account. ### Parameters - `account_id: str` Identifier - `direction: Optional[Literal["asc", "desc"]]` Direction to order widgets. - `"asc"` - `"desc"` - `filter: Optional[str]` Filter widgets by field using case-insensitive substring matching. Format: `field:value` Supported fields: - `name` - Filter by widget name (e.g., `filter=name:login-form`) - `sitekey` - Filter by sitekey (e.g., `filter=sitekey:0x4AAA`) Returns 400 Bad Request if the field is unsupported or format is invalid. An empty filter value returns all results. - `order: Optional[Literal["id", "sitekey", "name", 2 more]]` Field to order widgets by. - `"id"` - `"sitekey"` - `"name"` - `"created_on"` - `"modified_on"` - `page: Optional[float]` Page number of paginated results. - `per_page: Optional[float]` Number of items per page. ### Returns - `class WidgetListResponse: …` A Turnstile Widgets configuration as it appears in listings - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.turnstile.widgets.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) page = page.result[0] print(page.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" } ], "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ``` ## Turnstile Widget Details `turnstile.widgets.get(strsitekey, WidgetGetParams**kwargs) -> Widget` **get** `/accounts/{account_id}/challenges/widgets/{sitekey}` Show a single challenge widget configuration. ### Parameters - `account_id: str` Identifier - `sitekey: str` Widget item identifier tag. ### Returns - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) widget = client.turnstile.widgets.get( sitekey="0x4AAF00AAAABn0R22HWm-YUc", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(widget.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "secret": "0x4AAF00AAAABn0R22HWm098HVBjhdsYUc", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" } } ``` ## Create a Turnstile Widget `turnstile.widgets.create(WidgetCreateParams**kwargs) -> Widget` **post** `/accounts/{account_id}/challenges/widgets` Lists challenge widgets. ### Parameters - `account_id: str` Identifier - `domains: SequenceNotStr[WidgetDomain]` - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `direction: Optional[Literal["asc", "desc"]]` Direction to order widgets. - `"asc"` - `"desc"` - `filter: Optional[str]` Filter widgets by field using case-insensitive substring matching. Format: `field:value` Supported fields: - `name` - Filter by widget name (e.g., `filter=name:login-form`) - `sitekey` - Filter by sitekey (e.g., `filter=sitekey:0x4AAA`) Returns 400 Bad Request if the field is unsupported or format is invalid. An empty filter value returns all results. - `order: Optional[Literal["id", "sitekey", "name", 2 more]]` Field to order widgets by. - `"id"` - `"sitekey"` - `"name"` - `"created_on"` - `"modified_on"` - `page: Optional[float]` Page number of paginated results. - `per_page: Optional[float]` Number of items per page. - `bot_fight_mode: Optional[bool]` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Optional[Literal["no_clearance", "jschallenge", "managed", "interactive"]]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `ephemeral_id: Optional[bool]` Return the Ephemeral ID in /siteverify (ENT only). - `offlabel: Optional[bool]` Do not show any Cloudflare branding on the widget (ENT only). - `region: Optional[Literal["world", "china"]]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` ### Returns - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) widget = client.turnstile.widgets.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", domains=["203.0.113.1", "cloudflare.com", "blog.example.com"], mode="invisible", name="blog.cloudflare.com login form", ) print(widget.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "secret": "0x4AAF00AAAABn0R22HWm098HVBjhdsYUc", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" }, "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ``` ## Update a Turnstile Widget `turnstile.widgets.update(strsitekey, WidgetUpdateParams**kwargs) -> Widget` **put** `/accounts/{account_id}/challenges/widgets/{sitekey}` Update the configuration of a widget. ### Parameters - `account_id: str` Identifier - `sitekey: str` Widget item identifier tag. - `domains: SequenceNotStr[WidgetDomain]` - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `bot_fight_mode: Optional[bool]` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Optional[Literal["no_clearance", "jschallenge", "managed", "interactive"]]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `ephemeral_id: Optional[bool]` Return the Ephemeral ID in /siteverify (ENT only). - `offlabel: Optional[bool]` Do not show any Cloudflare branding on the widget (ENT only). - `region: Optional[Literal["world", "china"]]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` ### Returns - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) widget = client.turnstile.widgets.update( sitekey="0x4AAF00AAAABn0R22HWm-YUc", account_id="023e105f4ecef8ad9ca31a8372d0c353", domains=["203.0.113.1", "cloudflare.com", "blog.example.com"], mode="invisible", name="blog.cloudflare.com login form", ) print(widget.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "secret": "0x4AAF00AAAABn0R22HWm098HVBjhdsYUc", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" } } ``` ## Delete a Turnstile Widget `turnstile.widgets.delete(strsitekey, WidgetDeleteParams**kwargs) -> Widget` **delete** `/accounts/{account_id}/challenges/widgets/{sitekey}` Destroy a Turnstile Widget. ### Parameters - `account_id: str` Identifier - `sitekey: str` Widget item identifier tag. ### Returns - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) widget = client.turnstile.widgets.delete( sitekey="0x4AAF00AAAABn0R22HWm-YUc", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(widget.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "secret": "0x4AAF00AAAABn0R22HWm098HVBjhdsYUc", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" } } ``` ## Rotate Secret for a Turnstile Widget `turnstile.widgets.rotate_secret(strsitekey, WidgetRotateSecretParams**kwargs) -> Widget` **post** `/accounts/{account_id}/challenges/widgets/{sitekey}/rotate_secret` Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. ### Parameters - `account_id: str` Identifier - `sitekey: str` Widget item identifier tag. - `invalidate_immediately: Optional[bool]` If `invalidate_immediately` is set to `false`, the previous secret will remain valid for two hours. Otherwise, the secret is immediately invalidated, and requests using it will be rejected. ### Returns - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) widget = client.turnstile.widgets.rotate_secret( sitekey="0x4AAF00AAAABn0R22HWm-YUc", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(widget.ephemeral_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "bot_fight_mode": false, "clearance_level": "interactive", "created_on": "2014-01-01T05:20:00.123123Z", "domains": [ "203.0.113.1", "cloudflare.com", "blog.example.com" ], "ephemeral_id": false, "mode": "invisible", "modified_on": "2014-01-01T05:20:00.123123Z", "name": "blog.cloudflare.com login form", "offlabel": false, "region": "world", "secret": "0x4AAF00AAAABn0R22HWm098HVBjhdsYUc", "sitekey": "0x4AAF00AAAABn0R22HWm-YUc" } } ``` ## Domain Types ### Widget - `class Widget: …` A Turnstile widget's detailed configuration - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `secret: str` Secret key for this widget. - `sitekey: str` Widget item identifier tag. ### Widget Domain - `str` Hosts as a hostname or IPv4/IPv6 address represented by strings. The widget will only work on these domains, and their subdomains. ### Widget List Response - `class WidgetListResponse: …` A Turnstile Widgets configuration as it appears in listings - `bot_fight_mode: bool` If bot_fight_mode is set to `true`, Cloudflare issues computationally expensive challenges in response to malicious bots (ENT only). - `clearance_level: Literal["no_clearance", "jschallenge", "managed", "interactive"]` If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance, this setting can determine the clearance level to be set - `"no_clearance"` - `"jschallenge"` - `"managed"` - `"interactive"` - `created_on: datetime` When the widget was created. - `domains: List[WidgetDomain]` - `ephemeral_id: bool` Return the Ephemeral ID in /siteverify (ENT only). - `mode: Literal["non-interactive", "invisible", "managed"]` Widget Mode - `"non-interactive"` - `"invisible"` - `"managed"` - `modified_on: datetime` When the widget was modified. - `name: str` Human readable widget name. Not unique. Cloudflare suggests that you set this to a meaningful string to make it easier to identify your widget, and where it is used. - `offlabel: bool` Do not show any Cloudflare branding on the widget (ENT only). - `region: Literal["world", "china"]` Region where this widget can be used. This cannot be changed after creation. - `"world"` - `"china"` - `sitekey: str` Widget item identifier tag.