Vovy adds Cloudflare Turnstile, an invisible CAPTCHA, to your sign up and log in forms and turns on Supabase's CAPTCHA check.
Bots are signing up to my app, add a captcha
How it works
- Show who's signing up: Vovy opens Authentication, Users in Supabase and shows a card of suspicious patterns, like bursts of signups or throwaway email domains.
- Create a Turnstile widget: It adds a Turnstile widget in the Cloudflare dashboard for your domain and copies the site key and secret key.
- Turn on CAPTCHA in Supabase: Vovy opens Authentication, Attack Protection, enables CAPTCHA protection with Turnstile as the provider, and pastes in the secret key.
- Add Turnstile to your forms: In Cursor it adds the widget to sign up, log in and reset forms, and passes the captchaToken with each auth call.
- Test as a real person: It signs up in Chrome to confirm real users pass without a puzzle, and shows the Turnstile analytics page.
What you provide
- A Cloudflare account
- Your app's domain
What you get
- Bot protection on every auth form
- Server-side CAPTCHA checks
- A card of suspicious signups
- Turnstile analytics
FAQ
Will real users have to click traffic lights?
Rarely. Turnstile usually runs invisibly and only shows a checkbox when something looks off.
Is Turnstile free?
Yes, Turnstile's free plan covers most apps, and you don't need to host your site on Cloudflare.
Why did login break right after I turned this on?
Once CAPTCHA is on in Supabase, every auth request needs a token. Forms that don't send one fail, so Vovy updates all forms before testing.
Related tasks
All tasks