Set Up Cloudflare Turnstile for Revdoku Custom Domains

By Updated
Table of Contents

TL;DR: Revdoku protects public form submissions on managed *.localhost3000.love and *.revdoku.site addresses with a built-in CAPTCHA, no setup needed.

You only need your own Cloudflare Turnstile keys for a Revdoku custom domain when all of these are true:

  • your site is published on a custom domain (e.g. app.yourbrand.com), and
  • it accepts visitor submissions through built-in forms (feedback, contact, sign-ups, comments, etc.).

If your site on a custom domain is read-only, skip this.

Why? Cloudflare Turnstile keys are hostname-locked. Revdoku’s built-in widget allows the managed publication domains, so a custom domain needs its own hostname-approved widget.

Step 1: Open Cloudflare Turnstile for your custom domain

  1. Sign in to the Cloudflare dashboard.
  2. In the left sidebar, open Turnstile. (Direct link: https://dash.cloudflare.com/?to=/:account/turnstile.)

Turnstile is free.

Step 2: Add a widget

  1. Click Add widget.
  2. For Widget name, enter something recognizable, e.g. My app – app.yourbrand.com.

Step 3: Add your Revdoku custom domain as an allowed hostname

  1. Under Hostnames, add your exact published domain, e.g. app.yourbrand.com.
  2. If you serve both the apex and www, add both (yourbrand.com and www.yourbrand.com).
  3. You do not need to add localhost3000.love or revdoku.site; both managed domains are covered by the built-in key.

Step 4: Choose the widget mode

  • Select Managed (recommended). It shows a visible checkbox/challenge only when needed.
  • Do not pick an invisible/“interaction-only” mode. Revdoku renders one visible managed widget, and an invisible widget would issue no token, so every submission would fail.

Step 5: Create and copy the Turnstile keys

Click Create. Cloudflare shows:

Key What it is Where it goes in Revdoku
Site Key Public Turnstile site key. Safe to embed in the page. a Variable named CLOUDFLARE_TURNSTILE_SITE_KEY
Secret Key Private Turnstile secret key. Used server-side for verification. Never put it in the page. a Secret named CLOUDFLARE_TURNSTILE_SECRET_KEY

Keep this tab open.

Step 6: Add the Turnstile site key and Turnstile secret key to your Revdoku bucket

  1. In Revdoku, open the bucket for your site.
  2. Open Website settings → App → Variables & Secrets.
  3. Under Variables (public), add:
    • Name: CLOUDFLARE_TURNSTILE_SITE_KEY
    • Value: your Site Key from Cloudflare.
  4. Under Secrets (server-only), add:
    • Name: CLOUDFLARE_TURNSTILE_SECRET_KEY
    • Value: your Secret Key from Cloudflare.
  5. Click Save. Add both keys; one key alone won’t work.

Your Revdoku custom domain now uses your Cloudflare Turnstile widget for visitor submissions; the secret stays encrypted on Revdoku’s servers and never reaches the page.

Troubleshooting

  • Submissions fail with a Turnstile error: the site’s domain isn’t in the widget’s hostname list (Step 3), or only one of the two keys is saved (Step 6).
  • The widget never appears: make sure the mode is Managed, not invisible.
  • It worked on a managed Revdoku URL, but not the custom domain: that’s expected: the built-in key doesn’t cover custom domains. Add your own.

Just ask to “publish to Revdoku” to publish your as a fast and secure website

from your Codex, Claude or another AI apppublish files or folders

Paste this into your AI app.

Free · Public or protected · Visitor analytics · Forms and email alerts Building websites for clients? Explore Revdoku for agencies

Frequently Asked Questions

Do I need Cloudflare Turnstile keys on a managed Revdoku address?

No. Revdoku already includes CAPTCHA protection for public submissions on managed *.localhost3000.love and *.revdoku.site addresses. You only need your own keys when using a custom domain with visitor-facing write actions.

Do read-only custom domain sites need Turnstile keys?

No. If visitors cannot submit forms, you can skip Turnstile setup. The keys are only needed when public visitors can submit data on your site.

Which hostname should I add in Cloudflare Turnstile?

Add the exact domain where your Revdoku site is published, such as app.yourbrand.com. If your site is available on both the apex domain and www, add both hostnames.

Why does the custom domain need separate Turnstile keys?

Cloudflare Turnstile widgets are tied to approved hostnames. Revdoku’s built-in protection covers its managed publication domains, so it cannot validate submissions from your own domain. Your custom domain needs its own Cloudflare-approved widget.

Which Turnstile widget mode should I choose?

Use Managed mode. It works with Revdoku’s visible widget flow and only shows a challenge when Cloudflare decides one is needed. Invisible or interaction-only modes can prevent Revdoku from receiving a valid token.

Where should I store the Site Key and Secret Key in Revdoku?

Store the Site Key as a public variable named CLOUDFLARE_TURNSTILE_SITE_KEY. Store the Secret Key as a server-only secret named CLOUDFLARE_TURNSTILE_SECRET_KEY. Both must be saved for verification to work.

What should I check if submissions still fail?

First confirm that the exact custom domain is listed in the Turnstile widget’s hostnames. Then verify that both the public site key and server-only secret key are saved in Revdoku with the correct names. If the widget does not appear, check that the widget mode is Managed.

Share:
Markdown version
↧
Loading PDF…