# Set Up Cloudflare Turnstile for Revdoku Custom Domains

> Learn when Revdoku custom domains need Cloudflare Turnstile keys and how to add the site key and secret for secure public submissions.

TL;DR: Revdoku protects public form submissions on your free
`*.revdoku.site` address with a **built-in CAPTCHA**, no setup needed.

You only need your own Cloudflare Turnstile keys for a Revdoku custom domain when **all** of these are true:

- your site is published on a **custom domain** (e.g. `app.yourbrand.com`), **and**
- it accepts **visitor submissions** through built-in forms (feedback, contact, sign-ups, comments, etc.).

If your custom domain site is read-only, skip this.

> **Why?** Cloudflare Turnstile keys are hostname-locked.
> Revdoku's built-in widget only allows `*.revdoku.site`, so a custom domain
> needs its own hostname-approved widget.

---

## Step 1, Open Cloudflare Turnstile for your custom domain

1. Sign in to the [Cloudflare dashboard](https://dash.cloudflare.com/).
2. In the left sidebar, open **Turnstile**.
(Direct link: `https://dash.cloudflare.com/?to=/:account/turnstile`.)

Turnstile is free.

## Step 2, Add a widget

1. Click **Add widget**.
2. **Widget name**, something recognizable, e.g. `My app – app.yourbrand.com`.

## Step 3, Add your Revdoku custom domain as an allowed hostname

1. Under **Hostnames**, add your exact published domain, e.g.
`app.yourbrand.com`.
2. If you serve both the apex and `www`, add both (`yourbrand.com` and
`www.yourbrand.com`).
3. You do **not** need to add `revdoku.site`, that's covered by the built-in key.

## Step 4, Choose the widget mode

- Select **Managed** (recommended). It shows a visible checkbox/challenge only
when needed.
- Do **not** pick an invisible/"interaction-only" mode, Revdoku renders one
visible managed widget, and an invisible widget would issue no token, so every
submission would fail.

## Step 5, Create and copy the Turnstile keys

Click **Create**. Cloudflare shows:

| Key | What it is | Where it goes in Revdoku |
| --- | --- | --- |
| **Site Key** | Public Turnstile site key. Safe to embed in the page. | a **Variable** named `CLOUDFLARE_TURNSTILE_SITE_KEY` |
| **Secret Key** | Private Turnstile secret key. Used server-side to verify. **Never** put it in the page. | a **Secret** named `CLOUDFLARE_TURNSTILE_SECRET_KEY` |

Keep this tab open.

## Step 6, Add the Turnstile site key and Turnstile secret key to your Revdoku bucket

1. In Revdoku, open the bucket for your site.
2. Open **Website settings → App → Variables & Secrets**.
3. Under **Variables (public)**, add:
- Name: `CLOUDFLARE_TURNSTILE_SITE_KEY`
- Value: your **Site Key** from Cloudflare.
4. Under **Secrets (server-only)**, add:
- Name: `CLOUDFLARE_TURNSTILE_SECRET_KEY`
- Value: your **Secret Key** from Cloudflare.
5. Click **Save**. Add **both** keys; one key alone won't work.

Your Revdoku custom domain now uses your Cloudflare Turnstile widget for visitor
submissions; the secret stays encrypted on Revdoku's servers and never reaches
the page.

---

## Troubleshooting

- **Submissions fail with a Turnstile error**, the site's domain isn't in the
widget's hostname list (Step 3), or only one of the two keys is saved (Step 6).
- **The widget never appears**, make sure the mode is **Managed**, not invisible.
- **It worked on `*.revdoku.site`, but not the custom domain**, that's expected:
the built-in key doesn't cover custom domains. Add your own.

## Ask ChatGPT to check the protected site setup

Before sharing the link, ChatGPT can ask Revdoku which access mode is active for the bucket. Use this as a quick check for public, password, or email-gated publishing.

![ChatGPT checks Revdoku access mode for a protected demo bucket](/assets/en/blog/how-to-get-cloudflare-turnstile-keys-for-captcha-on-custom-domain/chatgpt-revdoku-access-mode-magic-stories.webp)

Start publishing for free

Connect this AI to Revdoku so it can store files, create, update, and publish websites for me. Read and follow https://revdoku.com/prompt.md. A Revdoku account is required. If I do not have one, send me https://app.revdoku.com/users/sign_up?utm_source=revdoku.com&utm_medium=ai-chat&utm_campaign=connect_ai_first and wait until I confirm signup is complete. For ChatGPT, Claude, or another cloud AI, connect https://app.revdoku.com/mcp and complete Revdoku OAuth. For a local agent, use Revdoku's browser device sign-in and complete the connection in Revdoku. Never ask me for a password or API key in chat, or for a verification code. When Revdoku tools are connected, verify the connection, tell me you’re ready, and ask what I want to publish.

Copy Prompt

or

Create Free Account

## Frequently asked questions

### Do I need Cloudflare Turnstile keys if I only use a revdoku.site address?

No. Revdoku already includes CAPTCHA protection for public submissions on free `*.revdoku.site` addresses. You only need your own keys when using a custom domain with visitor-facing write actions.

### Do read-only custom domain sites need Turnstile keys?

No. If visitors cannot submit forms, you can skip Turnstile setup. The keys are only needed when public visitors can submit data on your site.

### Which hostname should I add in Cloudflare Turnstile?

Add the exact domain where your Revdoku site is published, such as `app.yourbrand.com`. If your site is available on both the apex domain and `www`, add both hostnames.

### Why does the custom domain need separate Turnstile keys?

Cloudflare Turnstile widgets are tied to approved hostnames. Revdoku’s built-in protection is configured for `*.revdoku.site`, so it cannot validate submissions from your own domain. Your custom domain needs its own Cloudflare-approved widget.

### Which Turnstile widget mode should I choose?

Use Managed mode. It works with Revdoku’s visible widget flow and only shows a challenge when Cloudflare decides one is needed. Invisible or interaction-only modes can prevent Revdoku from receiving a valid token.

### Where should I store the Site Key and Secret Key in Revdoku?

Store the Site Key as a public variable named `CLOUDFLARE_TURNSTILE_SITE_KEY`. Store the Secret Key as a server-only secret named `CLOUDFLARE_TURNSTILE_SECRET_KEY`. Both must be saved for verification to work.

### What should I check if submissions still fail?

First confirm that the exact custom domain is listed in the Turnstile widget’s hostnames. Then verify that both the public site key and server-only secret key are saved in Revdoku with the correct names. If the widget does not appear, check that the widget mode is Managed.

---

[View the canonical page](https://revdoku.com/blog/how-to-get-cloudflare-turnstile-keys-for-captcha-on-custom-domain/) · [Browse llms.txt](https://revdoku.com/llms.txt)