All releases
Feature

Auth: bot protection on sign-up, and backend-only sign-up in the console

Auth apps can require a Cloudflare Turnstile or hCaptcha check on every sign-up, and can now switch sign-up to backend-only from the console or the API.

Turn on Bot protection under Auth → your app → Settings, pick Cloudflare Turnstile or hCaptcha and paste your site key and secret key. Your sign-up page renders the widget and sends its response as bot_protection_token on POST /{app_slug}/v1/auth/signup. Auth checks it with the provider before it looks at the email or password, so a bot gets no account and nobody gets a verification email they never asked for.

  • A missing token is 400 BOT_PROTECTION_REQUIRED, a rejected one 403 BOT_PROTECTION_FAILED. If the provider can't be reached, sign-up is refused with 503 BOT_PROTECTION_UNAVAILABLE instead of being let through.
  • Optionally only accept challenges solved on your own hostnames.
  • The secret key is stored encrypted and never shown again; the console shows its last four characters.
  • Each refusal is in the app's audit log as auth.signup.bot_protection_failed.

signup_requires_pak can now be set with PATCH /v1/apps/{app_id}/auth-config and from the new "Require a Platform API Key for signup" switch. With it on, only your backend can sign people up. The two work together: a backend that signs people up forwards the widget token it received.