Skip to main content

Cloudflare Turnstile

Cloudflare Turnstile confirms that a sign-in comes from a person's browser - it weighs the browser and how it behaves, usually without a puzzle - before the password is even looked at. It is off until you give it a site key and a secret key; without them the sign-in is exactly as it always was, and nothing is asked of Cloudflare. With them, the sign-in card and the multi-factor enrollment page show the Turnstile widget, and a sign-in without a token Cloudflare confirms is refused with "The sign-in could not be confirmed. Try again." before the password is even looked at.

Sign in with a passkey is checked the same way: the passkey prompt only opens once Cloudflare has confirmed the widget's token, and a refusal shows the same sentence on the sign-in card and counts like a refused password sign-in (see below).

So is Open console from the Odoo Management Plane: the server shows the widget and a Continue button before it signs you in. While Turnstile is on, no way into the console skips the check.

The settings are on Security > Threat protection > Turnstile. An old link to the former tab on Security > Firewall opens that tab.

Turnstile is for people signing in to the console. A program calling the management API with an API key already holds a credential and is not asked.

Switching it on​

  1. In the Cloudflare dashboard, open Turnstile and add a widget. List the host name the console is opened by - the server's host name, and the name of the proxy in front of it if there is one.
  2. Copy the widget's site key and secret key.
  3. On Security > Threat protection > Turnstile, paste both and Save. The change is a job; it applies from the next sign-in, with no restart.
SettingWhat it does
Site keyThe widget's public key. It is written into the sign-in page
Secret keyUsed by the server to ask Cloudflare about a token. Never shown again: type a new one to replace it
Remove the keysRemoves both, which switches Turnstile off
Host nameOptional. When set, a token solved on another host name is refused. Empty: the host name is not checked
Emergency bypassTurns Turnstile off and keeps the keys. See When it keeps everybody out

The same from the command line:

Remote or localagainst pelmo
$ ohm server turnstile set --site-key 0x4AAAAAAA... --secret-key

--secret-key on its own prompts for the key with the input masked; --secret-key-file <path> and --secret-key-stdin read its first line instead. A key typed on the command line is refused, so it never lands in the shell history. --hostname <name> sets the host name check and --hostname "" removes it. ohm server turnstile status shows the settings - the secret only as set or not set - and ohm server turnstile clear removes both keys.

A server can also get its keys at install: ANTELAO_INSTALL_TURNSTILE_SITE_KEY and ANTELAO_INSTALL_TURNSTILE_SECRET_KEY (see Install the server).

What Turnstile needs
  • The server must reach challenges.cloudflare.com over HTTPS. Turnstile fails closed: when Cloudflare cannot be asked, every console sign-in is refused.
  • The console must be opened by a host name the widget lists. Opened by IP address, or by a name the widget does not know, the widget refuses to work.

Refused challenges count as failed sign-ins​

A sign-in Turnstile refused - no token, or a token Cloudflare refused - counts like a wrong password: toward the Sign-in limit on Security > Firewall > Configuration, which refuses the address after too many failures, and as a failed sign-in in Server > Audit ("Turnstile refused"). It never counts against the account itself: the user name is unproven at that point, and counting it would let a bot lock real people out. A refusal because Cloudflare could not be reached never counts.

The switch is Count refused challenges ("Count a sign-in Turnstile refuses as a failed sign-in"), in the Turnstile section of Security > Firewall > Configuration, beside the Sign-in limit, on by default. Switched off, a refused challenge is still refused and still in the audit trail, once per address per minute, and costs the address nothing.

Remote or localagainst pelmo
$ ohm server turnstile set --count-failures off

When it keeps everybody out​

Wrong keys, a Cloudflare outage, a firewall that blocks Cloudflare, a console opened by a name the widget does not list: any of them keeps every administrator out of the console. Turn Turnstile off from the server itself:

Local only
$ sudo ohm server turnstile disable

It needs neither the console nor the management API: it writes the setting straight into the master database, and the next sign-in is not checked. The keys stay. While the bypass is on, Administrators see a banner on every page, the management API says so in its log, and the change is in Server > Audit (turnstile.bypassed). Put the cause right, then:

Local only
$ sudo ohm server turnstile enable

The Emergency bypass switch on the Turnstile tab does the same once you are back in. The State row then reads "Bypassed: the keys are kept, Turnstile is not asked."

There is a second, host-level way, for when the master database itself is not to be touched: ANTELAO_BOOT_TURNSTILE_BYPASS=true in /etc/antelao/agent.env, followed by sudo ohm install, which recreates the management containers with Turnstile off. It wins over the setting, so enable cannot turn Turnstile back on while it is there: remove the line and repair again.

Last updated on