Turnstile renders a self-contained widget. When it succeeds it hands your callback a token, which we POST to /api/captcha/vendor. Our server calls Cloudflare's siteverify endpoint and returns the verdict.
Three published TEST sitekeys let you drive each branch deterministically:
pass — always issues a passing token → humanblock — the widget never yields a valid token → bot (the negative branch)interactive — forces a visible challenge before it will issue a token
Pairs with the Shadow DOM lesson: Turnstile wraps its controls in its own iframe (and shadow tree), so you cannot reach inside from the top frame — assert on the token and on #captcha-result instead.
Mode: practice — the test keys are deterministic; great for wiring up your automation end to end.
