If you're looking for a simple way to add Cloudflare Turnstile to Devise, there isn't an official integration.
You can certainly wire everything up yourself by overriding Devise views, rendering the Turnstile widget, validating tokens, and handling verification failures. It works, but it's a surprising amount of boilerplate for something every authentication system needs.
That's why I built devise-cloudflare-turnstile.
It integrates Cloudflare Turnstile directly into Devise with minimal configuration.
Why Cloudflare Turnstile?
Traditional CAPTCHAs frustrate users and create unnecessary friction during authentication.
Cloudflare Turnstile provides a much better experience:
- Invisible for most legitimate users
- Free to use
- Privacy focused
- Excellent bot protection
- Easy to integrate
It's a great fit for login, registration, and other authentication flows.
Installation
Add the gem to your Gemfile:
gem "devise-cloudflare-turnstile"
Install the gem and run the installer:
bundle install
bin/rails generate devise_cloudflare_turnstile:install
The installer creates a config/initializers/cloudflare_turnstile.rb initializer.
Next, add the required helpers to your application's <head> section:
<%= devise_turnstile_meta_tag %>
<%= devise_turnstile_scripts %>
These helpers render nothing on non-Devise pages, so they're safe to include in your shared application layout.
Finally, configure your Cloudflare Turnstile credentials:
export CLOUDFLARE_TURNSTILE_SITE_KEY=your_site_key
export CLOUDFLARE_TURNSTILE_SECRET_KEY=your_secret_key
That's it. Your Devise authentication forms are now protected by Cloudflare Turnstile.
What Gets Protected?
devise-cloudflare-turnstile integrates with Devise's built-in authentication flows, including:
- Sign in
- Sign up
- Password reset
- Email confirmation
No custom controllers.
No view overrides.
No manual token verification.
Why I Built It
I previously released cloudflare-turnstile-rails, a general-purpose Rails integration for Cloudflare Turnstile.
While it works well for any Rails form, I found myself implementing the same Devise integration repeatedly across projects.
devise-cloudflare-turnstile packages that work into a gem that feels native to Devise, so you can add bot protection in just a few minutes instead of rebuilding the integration yourself.
Get Started
If you're looking for the easiest way to add Cloudflare Turnstile to Devise, check out devise-cloudflare-turnstile.
