- How do I install filament-turnstile in a Laravel Filament app?
- Run composer require l3aro/filament-turnstile, then publish the config with php artisan vendor:publish --tag=filament-turnstile-config. Optionally publish views with the filament-turnstile-views tag. Add TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY to your .env file, then add the Turnstile::make('captcha') field to a Filament form schema.
- How do I add Cloudflare Turnstile to a Filament login page?
- The README recipe subclasses Filament's auth Login page, overrides getForms() to include the Turnstile field, and overrides throwFailureValidationException() for the CAPTCHA failure. You then re-point the panel's login page in the PanelProvider via login(). The assessment calls this recipe copy-pasteable and low risk, but check it against your installed Filament major because the example uses v3 APIs.
- Which Filament versions does filament-turnstile support?
- The changelog shows Filament 5 support landed in 1.0.6 and Laravel 13 support in 1.1.0, but the README example still uses Filament v3 APIs such as Form and schema(). The docs do not provide a reliable compatibility matrix, so confirm the installed Filament major before estimating. Pin an exact minor such as ^1.1.1 and record the Filament version in the ticket.
- Does filament-turnstile verify the Turnstile token server-side?
- The README excerpt does not document the server-side siteverify call, token single-use semantics, or the 300-second token lifetime. Treat server-side verification as a gating question and inspect the released source or test the failure path, because a client-only CAPTCHA is decorative. Verify behavior on network timeout versus an explicit success false response.
- Can I use filament-turnstile in development or CI without Turnstile keys?
- The assessment notes that v1.1.1 says credentials are 'only required if credentials are configured,' but the exact behavior is ambiguous. Test keyless rendering in dev and CI before depending on it, and confirm whether validation is skipped or fails. If it does not work keyless, gate the field by environment or use Cloudflare test keys.
- How do I customize the Cloudflare Turnstile reset event name?
- Set TURNSTILE_RESET_EVENT in your .env file or change reset_event in the published config file. The default event name is reset-captcha, and the setting is global rather than per field. The assessment describes the reset as a client-side Livewire browser event, so choose a unique name to avoid conflicts with your own JavaScript and confirm non-Livewire dispatch behavior if needed.
- What CSP domains do I need to allow for Cloudflare Turnstile?
- Cloudflare Turnstile loads from challenges.cloudflare.com, so your Content Security Policy must allowlist the required Cloudflare domains for script, frame, and connect as applicable. The assessment flags CSP as an open question because the README does not enumerate the domains. Test against your actual CSP and avoid broad wildcards.
- Is filament-turnstile safe for production given its low adoption?
- Adoption is low: about 11 stars, zero dependents, and a single maintainer, with no third-party evidence of production use. The package is MIT licensed and only a few hundred lines, so you can vendor or fork it cheaply, which materially reduces bus-factor risk. Budget for being the QA and verify the server-side verification path yourself.
- Can I migrate from reCAPTCHA or hCaptcha to filament-turnstile?
- There is no automated migration path from reCAPTCHA or hCaptcha. Treat it as a small enumerable refactor: swap the widget per form and remove the old verification rule. If you run both CAPTCHAs in parallel, do it only in staging to avoid double-challenge friction.
- How do I test Filament Turnstile forms with Pest?
- The package ships with a Pest test suite and GitHub Actions for tests and code style, but your app tests should cover the form field, reset event, and server-side verification behavior. Use Cloudflare test keys where possible and assert both success and failure paths. Confirm the installed Filament major before writing test expectations because README examples may target v3 APIs.