CAPTCHA protection

• Requesting an email or SMS OTP — captcha is required when the code is sent, covering both signup and login flows.
• Creating a new account (sub-organization) — captcha is required during signup via passkey, OAuth / social login, or external wallet.

​

Enabling CAPTCHA

1

Open your organization settings

Log in to the Turnkey Dashboard and navigate to Settings for your organization.

2

Find the CAPTCHA toggle

Locate the CAPTCHA protection setting in the Security section of your organization settings.

3

Enable CAPTCHA

Toggle the setting on and save your changes. CAPTCHA protection is now active for your organization.

​

How it works

1. When a user initiates a protected flow (sending an OTP or signing up for a new account), the Turnstile widget renders inside the auth UI.
2. Turnstile performs its challenge in the background. For most legitimate users, this is invisible or requires a single click.
3. On success, Turnstile issues a token that is passed along with the request to Turnkey’s backend for verification.
4. Requests that fail the CAPTCHA challenge are rejected before any auth activity is created.

// No changes needed — CAPTCHA is handled automatically by the SDK
import { useTurnkey } from "@turnkey/react-wallet-kit";

function LoginButton() {
  const { handleLogin } = useTurnkey();
  return <button onClick={handleLogin}>Login / Sign Up</button>;
}

​

Protected auth methods

​

Related

• Auth Proxy
• Authentication overview
• React Wallet Kit — Authentication
• React Wallet Kit — Getting started