What Turnstile returns
Turnstile runs browser challenges and issues a token. Your server validates it with Cloudflare's Siteverify API, which returns a success flag, hostname, and any action or custom data. Tokens expire after five minutes and can be validated once. Cloudflare documents the validation fields.
Cloudflare offers a free plan and an Enterprise plan. Ephemeral device identifiers are available with Enterprise Turnstile. Check the plan comparison if you need those identifiers.
What Heretic adds
Heretic returns contradicted, refused, or uncontradicted, with named findings and their tiers. Your backend can
inspect a specific condition, such as a replaced navigator getter or a TCP signature that
conflicts with the claimed operating system.
The result includes the observed address and available site-scoped identifiers. These support comparisons with your account records. A matching identifier means matching browser inputs; distinct devices can share those inputs.
The phone challenge
When your policy requires a challenge, the visitor follows motion instructions on a phone and confirms with a passkey. Your server receives the outcome and device records. A desktop visitor continues on a phone through a rolling QR code.
The passkey signature binds the browser's measurements to this challenge. It does not authenticate the motion sensor or prove a unique person. The outcome reference explains what a pass establishes.
Switching the integration
Heretic uses a script tag, a widget element, and a hidden response field. Its POST /v1/siteverify accepts the familiar secret and response fields,
then adds the original probe verdict and any challenge result.
Update the script URL, widget class and attributes, response-field name, keys, and verification endpoint. Set the expected hostname, action, and attempt ID on your backend. The widget guide includes the code and server checks.
Choosing between them
Turnstile provides challenge verification with a free plan. Heretic is useful when your application also needs to inspect browser contradictions or compare device inputs across account attempts. Test the responses and completion flow against those requirements.