go-shortner-docs
Captcha

Cloudflare Turnstile

Configure privacy-preserving bot detection and CAPTCHA protection with Cloudflare Turnstile.

Cloudflare Turnstile

GO Shortener integrates with Cloudflare Turnstile to provide smart, frictionless bot detection without frustrating users with distorted text or puzzle challenges.

Why Turnstile?

  • Privacy-Preserving: Turnstile does not harvest user browsing data or use tracking cookies across the web.
  • Frictionless Experience: Most legitimate users pass automatically without an interactive prompt.
  • Server-Side Verification: Form submissions include a Turnstile response token which the GO backend validates directly against Cloudflare's verification API.

Setting Up Cloudflare Turnstile

1. Access Cloudflare Turnstile Dashboard

Log into the Cloudflare Dashboard and select Turnstile from the navigation sidebar.

2. Add a New Widget

Click Add Site and fill out the configuration:

  • Site name: GO Shortener Production
  • Domain: Add your hostname, e.g. go.arcn.online (you can also add localhost for testing).
  • Widget Mode: Choose Managed (recommended) or Non-interactive.

3. Retrieve Keys

Once created, Cloudflare displays your credentials:

  • Site Key: A public key embedded in web forms.
  • Secret Key: A confidential key used by the backend to verify tokens.
Never expose your TURNSTILE_SECRET_KEY. Do not commit it to source control or embed it into client-side JavaScript. Keep it strictly inside your production .env file.

Environment Variables

To enable Turnstile in GO Shortener, add the following variables to your /root/Go-shortner/.env:

.env
# Enable CAPTCHA Protection
TURNSTILE_ENABLED=true

# Public Widget Key
TURNSTILE_SITE_KEY=0x4AAAAAA...your_site_key

# Private Secret Key
TURNSTILE_SECRET_KEY=0x4AAAAAA...your_secret_key

Enabling and Disabling Turnstile

  • To Enable: Set TURNSTILE_ENABLED=true and restart the service. The frontend will automatically load the Turnstile widget on registration and anonymous shortening forms, and the backend will enforce token verification.
  • To Disable: Set TURNSTILE_ENABLED=false and restart the service. Forms will bypass CAPTCHA checks (ideal for local development or closed enterprise networks).
Terminal
systemctl restart go-shortener

Backend Verification Logic

When a user submits a form protected by Turnstile:

  1. The browser requests a verification token from Cloudflare's widget.
  2. The client sends the token in the request payload (cf-turnstile-response).
  3. The GO backend issues an HTTP POST to https://challenges.cloudflare.com/turnstile/v0/siteverify containing:
    • secret: Your TURNSTILE_SECRET_KEY
    • response: The user's submitted token
    • remoteip: The user's hashed IP
  4. If Cloudflare returns {"success": true}, the operation proceeds; otherwise, the request is rejected with 403 Forbidden.

Firebase Setup

Step-by-step instructions for configuring Firebase Authentication and Google OAuth.

Admin Panel

Overview of the administrative command center, role hierarchy, and permissions.

Copyright © 2026