success property inside the response datasuccess
O
J
(!$response['success'])
H
S
RR
R
S
D
invalid-input-responseDDD
ADDDDP
D
XXXXS
T
YY
~
PB
invalid-input-secret when attempting to validate a token with the 1x0000000000000000000000000000000AA test secret and a token from the client. I've broken it down to be able to reproduce with a curl command:invalid-input-secret error message, when that's definitely not the problem, especially when using the test key that should make the token always pass?BBBBhey-you're-using-a-test-key-with-a-real-response for this instead?BBB(!$response['success'])invalid-input-response // Helper function to make POST requests using fetch
const postRequest = async (data:any) => {
const response = await fetch(url, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify(data),
});
return response.json(); // Parse and return JSON response
};
// Generate an idempotency key for the request
const idempotencyKey = crypto.randomUUID();
const firstOutcome = await postRequest({
secret: SECRET_KEY,
response: token,
remoteip: ip,
idempotency_key: idempotencyKey,
});invalid-input-secretinvalid-input-secret1x0000000000000000000000000000000AAcurl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"asdf"}' -H "Content-Type: application/json" -i
# succeeds
curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"my-token-here"}' -H "Content-Type: application/json" -i
# fails with {"success":false,"error-codes":["invalid-input-secret"],"messages":[]}hey-you're-using-a-test-key-with-a-real-response