- How do I install coderflex/filament-turnstile in a Laravel app?
- Install it with Composer using the package major that matches your Filament major, then add TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY to your .env file. No migrations, service layer, or database changes are involved for basic use. After that, add the Turnstile component to a Filament form schema where you want the challenge to appear.
- Which package version supports Filament v3, v4, or v5?
- Version 1.x targets Filament V2, 2.x targets Filament V3, 3.x targets Filament V4, and 4.x targets Filament V5. Require the matching major so Composer does not pull an incompatible Filament constraint. The Filament V5 line also requires PHP 8.4 and Laravel 11 through 13.
- How do I add Cloudflare Turnstile to the Filament login page?
- Subclass Filament's Login page, add Coderflex\FilamentTurnstile\Forms\Components\Turnstile to the form schema, and override throwFailureValidationException() to dispatch the reset-captcha browser event. Then point ->login(Login::class) at your subclass in the PanelProvider. This is additive and reversible without editing vendor code.
- Where do I get the Turnstile site key and secret key?
- Create a Turnstile widget in the Cloudflare dashboard and copy its generated site key and secret key. Put them in your .env as TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY for each environment. Keep the secret key out of source control and manage it through your normal secrets path.
- Does Filament Turnstile work with Filament V5 and PHP 8.4?
- Yes, the 4.x line targets Filament V5 and pulls coderflex/laravel-turnstile ^2.0. That line requires PHP 8.4 and Laravel 11 through 13, so confirm your runtime floors before upgrading. Budget this plugin major upgrade alongside each Filament major upgrade rather than treating it as a one-time install.
- How can I test Turnstile locally or in CI without real Cloudflare keys?
- Cloudflare publishes dummy keys for testing, including site key 1x00000000000000000000AA and secret key 1x0000000000000000000000000000000AA, which always pass. Set those in your testing .env so feature tests can submit forms without loading the live challenge. For browser QA, still verify the widget renders and the reset event fires after a failed validation.
- Why does the Turnstile widget not reset after a failed Filament login?
- Turnstile tokens are single-use, so a failed login leaves a stale token unless the widget is explicitly reset. The documented pattern is to override throwFailureValidationException() on your Login page and dispatch the reset-captcha browser event. If you skip that override, users can get stuck and be unable to resubmit the form.
- Can I use Filament Turnstile on registration and password reset forms?
- Yes, the component is a normal Filament form field, so it can be added to any form schema, including registration, password reset, and custom public forms. The main decisions are scope and per-environment key provisioning. More protected surfaces mean more QA, especially around conditional or hidden fields in Livewire-rendered forms.
- Is Filament Turnstile maintained and safe for production use?
- It is a thin view-layer adapter, so the real security surface is Cloudflare Turnstile and the underlying Laravel Turnstile validation rather than the plugin itself. The project is small, with a single primary maintainer and few dependents, so regressions will likely surface in your environment first. Treat it as maintained enough to track Filament majors rather than as a heavily battle-tested dependency.
- What are alternatives if I do not want another Filament plugin dependency?
- You can fork or inline the component, which is only a few hundred lines and mainly wires configuration plus the reset event into Filament's form API. That keeps the Cloudflare Turnstile integration while removing the third-party release cadence. Another option is to use coderflex/laravel-turnstile directly and render your own Filament field.