# Set Up Cloudflare Turnstile for Revdoku Custom Domains

> Learn when Revdoku custom domains need Cloudflare Turnstile keys and how to add the site key and secret for secure public submissions.

TL;DR: Revdoku protects public form submissions on managed
`*.localhost3000.love` and `*.revdoku.site` addresses with a **built-in CAPTCHA**, no setup needed.

You only need your own Cloudflare Turnstile keys for a Revdoku custom domain when **all** of these are true:

- your site is published on a **custom domain** (e.g. `app.yourbrand.com`), **and**
- it accepts **visitor submissions** through built-in forms (feedback, contact, sign-ups, comments, etc.).

If your site on a custom domain is read-only, skip this.

> **Why?** Cloudflare Turnstile keys are hostname-locked.
> Revdoku's built-in widget allows the managed publication domains, so a custom domain
> needs its own hostname-approved widget.

---

## Step 1: Open Cloudflare Turnstile for your custom domain

1. Sign in to the [Cloudflare dashboard](https://dash.cloudflare.com/).
2. In the left sidebar, open **Turnstile**.
(Direct link: `https://dash.cloudflare.com/?to=/:account/turnstile`.)

Turnstile is free.

## Step 2: Add a widget

1. Click **Add widget**.
2. For **Widget name**, enter something recognizable, e.g. `My app – app.yourbrand.com`.

## Step 3: Add your Revdoku custom domain as an allowed hostname

1. Under **Hostnames**, add your exact published domain, e.g.
`app.yourbrand.com`.
2. If you serve both the apex and `www`, add both (`yourbrand.com` and
`www.yourbrand.com`).
3. You do **not** need to add `localhost3000.love` or `revdoku.site`; both managed domains are covered by the built-in key.

## Step 4: Choose the widget mode

- Select **Managed** (recommended). It shows a visible checkbox/challenge only
when needed.
- Do **not** pick an invisible/"interaction-only" mode. Revdoku renders one
visible managed widget, and an invisible widget would issue no token, so every
submission would fail.

## Step 5: Create and copy the Turnstile keys

Click **Create**. Cloudflare shows:

| Key | What it is | Where it goes in Revdoku |
| --- | --- | --- |
| **Site Key** | Public Turnstile site key. Safe to embed in the page. | a **Variable** named `CLOUDFLARE_TURNSTILE_SITE_KEY` |
| **Secret Key** | Private Turnstile secret key. Used server-side for verification. **Never** put it in the page. | a **Secret** named `CLOUDFLARE_TURNSTILE_SECRET_KEY` |

Keep this tab open.

## Step 6: Add the Turnstile site key and Turnstile secret key to your Revdoku bucket

1. In Revdoku, open the bucket for your site.
2. Open **Website settings → App → Variables & Secrets**.
3. Under **Variables (public)**, add:
- Name: `CLOUDFLARE_TURNSTILE_SITE_KEY`
- Value: your **Site Key** from Cloudflare.
4. Under **Secrets (server-only)**, add:
- Name: `CLOUDFLARE_TURNSTILE_SECRET_KEY`
- Value: your **Secret Key** from Cloudflare.
5. Click **Save**. Add **both** keys; one key alone won't work.

Your Revdoku custom domain now uses your Cloudflare Turnstile widget for visitor
submissions; the secret stays encrypted on Revdoku's servers and never reaches
the page.

---

## Troubleshooting

- **Submissions fail with a Turnstile error**: the site's domain isn't in the
widget's hostname list (Step 3), or only one of the two keys is saved (Step 6).
- **The widget never appears**: make sure the mode is **Managed**, not invisible.
- **It worked on a managed Revdoku URL, but not the custom domain**: that's expected:
the built-in key doesn't cover custom domains. Add your own.

Just ask to “publish to Revdoku” to
publish your HTML pages presentation dashboard app prototype game prototype
as a fast and secure website

from your Codex , Claude or another AI app publish files or folders

Connect
Skill
MCP

Paste this into your AI app.

Copy

Install the Revdoku skill in your AI app.

Copy
npx skills add revdoku/revdoku --skill revdoku -g

Choose your AI app to connect through MCP.

Codex CLI
Claude Code
Other

Copy codex mcp add revdoku --url https://app.revdoku.com/mcp
codex mcp login revdoku

Copy claude mcp add --transport http revdoku https://app.revdoku.com/mcp
claude mcp login revdoku

Transport Streamable HTTP Auth Browser OAuth

Copy https://app.revdoku.com/mcp

Open the MCP setup guide →

Free · Public or protected · Visitor analytics · Forms and email alerts Building websites for clients? Explore Revdoku for agencies →

## Frequently Asked Questions

### Do I need Cloudflare Turnstile keys on a managed Revdoku address?

No. Revdoku already includes CAPTCHA protection for public submissions on managed `*.localhost3000.love` and `*.revdoku.site` addresses. You only need your own keys when using a custom domain with visitor-facing write actions.

### Do read-only custom domain sites need Turnstile keys?

No. If visitors cannot submit forms, you can skip Turnstile setup. The keys are only needed when public visitors can submit data on your site.

### Which hostname should I add in Cloudflare Turnstile?

Add the exact domain where your Revdoku site is published, such as `app.yourbrand.com`. If your site is available on both the apex domain and `www`, add both hostnames.

### Why does the custom domain need separate Turnstile keys?

Cloudflare Turnstile widgets are tied to approved hostnames. Revdoku’s built-in protection covers its managed publication domains, so it cannot validate submissions from your own domain. Your custom domain needs its own Cloudflare-approved widget.

### Which Turnstile widget mode should I choose?

Use Managed mode. It works with Revdoku’s visible widget flow and only shows a challenge when Cloudflare decides one is needed. Invisible or interaction-only modes can prevent Revdoku from receiving a valid token.

### Where should I store the Site Key and Secret Key in Revdoku?

Store the Site Key as a public variable named `CLOUDFLARE_TURNSTILE_SITE_KEY`. Store the Secret Key as a server-only secret named `CLOUDFLARE_TURNSTILE_SECRET_KEY`. Both must be saved for verification to work.

### What should I check if submissions still fail?

First confirm that the exact custom domain is listed in the Turnstile widget’s hostnames. Then verify that both the public site key and server-only secret key are saved in Revdoku with the correct names. If the widget does not appear, check that the widget mode is Managed.

---

[View the canonical page](https://revdoku.com/blog/how-to-get-cloudflare-turnstile-keys-for-captcha-on-custom-domain/) · [Browse llms.txt](https://revdoku.com/llms.txt)