demo: turnstile challenge widget

a small contact-form-shaped page with cloudflare turnstile guarding submit. the widget issues a short-lived token in the browser; the pages function calls turnstile's siteverify api server-side before accepting the form.

# form

# how it works

1. widget loads from challenges.cloudflare.com, runs a browser challenge
2. on pass, injects a token into a hidden cf-turnstile-response input
3. form posts that token to /api/turnstile-verify
4. function calls https://challenges.cloudflare.com/turnstile/v0/siteverify with the secret + token
5. if success: true, form is accepted

# config