Setting up Cloudflare Turnstile in Authentik

#

Cloudflare Turnstile is a modern alternative to CAPTCHA that lets you protect authentication forms from bots and brute-force attacks without forcing users to decipher images or type in characters.

Why use Cloudflare Turnstile in Authentik

#

By default, Authentik already has decent protection against:

• brute-force attacks;
• username enumeration;
• automated login attempts.

However, when exposing your IdP to the internet, this is often not enough.

Cloudflare Turnstile lets you:

• filter out bots before the flow even runs;
• reduce the load on Authentik;
• improve the user experience compared to classic CAPTCHAs;
• raise the overall security level without complicating your flow logic.

In other words, in addition to the authentication and authorization methods we already set up in previous articles, we’re adding one more verification method.

Visually, it looks something like this

Requirements

#

Before you start, make sure that:

• you have a Cloudflare account;
• the domain where Authentik is hosted has been added to Cloudflare.

Unfortunately, these are mandatory requirements for using this technology.

Creating a Turnstile widget in Cloudflare

#

1. Go to the Cloudflare dashboard.
2. Open the Security > Turnstile section (Cloudflare periodically moves menu items between sections — at the time of writing this was under “Protect & Connect”, now it’s moved to “Security”. If you still can’t find it, just search for “Turnstile” in the dashboard search).
3. Click Add Widget (in some UI versions the button is already called Add site).
4. Specify:
   • Widget name - any name you like (e.g. authentik-login);
   • Add Hostname > Domains - the domain where Authentik runs;
   • Widget mode - Managed (recommended for home use).
   • Pre-Clearance Mode - Yes
   • Level of pre-clearance - interactive

Once created, you’ll receive:

• Site Key
• Secret Key

You can copy them, but Cloudflare kindly notes that you’ll always be able to access them again later.

Creating a Captcha Stage in Authentik

#

Configuring the stage in Authentik

#

Now let’s move on to the configuration in Authentik.

1. Open the Authentik admin panel.
2. Go to Flows and Stages → Stages.
3. Click Create.
4. Select Captcha Stage.

5. Give the stage a name.
6. For the verification type, select Cloudflare Turnstile.
7. In the Public key and Private Key fields, enter the values we got from Cloudflare.
8. You can leave the Interactive toggle enabled if your Turnstile is configured as Invisible or Managed.

   

Don’t touch anything in the Advanced Settings section. In the version of Authentik current as of writing, the correct values are already filled in automatically. Previously you had to enter them manually. You can read more in the official documentation

9. Finish

Integrating the Turnstile stage into the main authentication and authorization flow

#

1. Open the Authentik admin panel.
2. Go to Flows and Stages → Flows → default-authentication-flow.
3. Select Stage Bindings → Bind Existing Stage
4. Select the stage we just created.
5. Choose the processing order for the Turnstile stage - after the authentication stage, but before the password entry stage.
6. Select evaluate when flow is planned.
7. Create

We’ve now integrated the “captcha” stage into Authentik’s authentication process.