---
title: "Verify Turnstile"
method: POST
path: "/auth/turnstile/verify"
tags: ["auth"]
---

# Verify Turnstile

`POST /auth/turnstile/verify`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/turnstile/verify`
- Auth: none declared

Public: confirms a Cloudflare Turnstile widget response token server-side (forwarding the caller's IP as `remoteip`) and reports pass/fail. A failed challenge is returned as 200 `{success:false, ...error codes}`, not a 4xx, so the client can distinguish "try the widget again" from a malformed request; 503 if no Turnstile secret is configured on this deployment (fails loud rather than silently passing every caller).

## Request body

- InternalDeliveryHttpHandlerTurnstileVerifyRequest
  - `token` string

## Response `200`

OK

- InternalDeliveryHttpHandlerTurnstileVerifyResponse
  - `action` string
  - `error_codes` string[]
  - `hostname` string
  - `success` boolean: deprecated: token validity, NOT request success — read Valid
  - `valid` boolean

## Other responses

- `400`: Bad Request
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)