How To Get Your Turnstile Keys From Cloudflare

Your contact form looks right. You publish it, type a test message, press Send, and the visitor gets a page saying "Forms Not Active". Nothing is broken. The form is waiting on a captcha key pair, and on OxyPages that pair is not optional: every submission is rejected until one is saved.

The fix is your Turnstile keys, issued free by Cloudflare. Turnstile is Cloudflare's captcha. It costs nothing, needs no Google account, and most visitors never have to click anything to prove they are human.

Setting that up takes about three minutes and no credit card. You make a Cloudflare account, add a widget, tell that widget which hostname your form is served from, and copy two strings into Form Settings. The hostname step is where nearly everyone slips. Put the wrong address in and the widget quietly refuses to render, which looks exactly like a broken captcha.

This guide walks the whole path, then shows which key goes where and which one must never appear in your page HTML. If you only want the click path, the captcha setup article is the two-minute version.

What Are Your Turnstile Keys, And Why Does A Form Need Them?

Your Turnstile keys are two strings Cloudflare issues for one widget: a sitekey that identifies the widget in the visitor's browser, and a secret key that lets a server ask Cloudflare whether the token that visitor produced is genuine.

Captcha is mandatory for forms here. Until a provider is saved in Form Settings, every submission on your published site is rejected and visitors see a "Forms Not Active" page. That is the single most common reason a form looks broken, and it is not a bug.

Form Settings offers two providers: Cloudflare Turnstile, marked as recommended, and Google reCAPTCHA v3. reCAPTCHA v3 scores visitors invisibly and works fine, but it needs a Google account to register your domain, which is why the recommendation sits with Turnstile. Either is a full replacement for the other, and switching later just means saving a different pair.

You never write any captcha code yourself. When a page holding a form is served, the widget and a hidden honeypot field are added to that form for you, along with the provider's script. Adding the form is one attribute on the form tag; the captcha half is entirely settings.

Which Key Is Which

Getting these two backwards is a confusing failure: the widget renders, the visitor passes the challenge, and the submission is still rejected, because the server check cannot verify a token with a sitekey.

How Do You Get Your Turnstile Keys From Cloudflare?

You create a free Cloudflare account, open the Turnstile section, add a widget, and the keys appear on screen the moment you press Create. Four steps, start to finish.

Step 1: Create A Cloudflare Account

Go to the Turnstile dashboard. If you have no Cloudflare account yet, sign up with an email address and verify it. You do not need to move a domain to Cloudflare, you do not need a paid plan, and you are not asked for a card. The free tier covers up to 20 widgets per account with unlimited challenges.

Form Settings links to this same page from beside the provider choice, so you can start from either end.

Step 2: Add A Widget

Select Add widget. Cloudflare asks for three things:

• Widget name - anything you will recognise in six months. The site's address works well, for example sunrise-cafe contact form.
• Hostname - the address your form is served from. Every widget needs at least one, and this is the field that goes wrong.
• Widget mode - Managed, Non-Interactive or Invisible.

Step 3: Pick A Widget Mode

Managed is the right default for a contact form. The three modes differ only in what the visitor sees while the check runs.

The widget is placed inside your form automatically whichever mode you choose, so Invisible simply leaves that spot empty. Keep Managed unless the widget spoils a design: a visitor who does get challenged then sees a normal Cloudflare checkbox rather than a silent failure.

Step 4: Copy Both Keys

Select Create. Cloudflare shows both keys together on one screen, and that is the only time you see them side by side, so copy them now. The sitekey stays readable in the widget's settings afterwards. If the secret goes missing, rotate it from the same place to issue a fresh one.

Which Hostname Makes The Turnstile Keys Work?

Enter the exact address a visitor sees in the browser bar on the page that holds the form, with no https:// in front and no path after it. Get this field wrong and the widget never loads, which leaves you with a pair of keys that are perfectly valid and completely useless.

On a free subdomain that is the whole subdomain: sunrise-cafe.myoxypages.com. Not myoxypages.com, and not sunrise-cafe on its own. On a connected custom domain it is the hostname you connected, such as www.example.com.

Two Cloudflare rules make this less fiddly than it sounds:

• Adding a hostname also covers every subdomain beneath it, so example.com covers www.example.com and shop.example.com too.
• Wildcard characters such as * are not supported in the hostname field, so *.example.com is not a valid entry.

A free widget holds up to 10 hostnames, so list every address the form is reachable at. A site answering on both a custom domain and its original subdomain needs both. Cloudflare's hostname management docs have the full rules.

The Mistakes That Stop The Widget Appearing

• Entering myoxypages.com on its own. It is not your site's address, and not a domain you control.
• Including the scheme or a path. https://sunrise-cafe.myoxypages.com/contact.html is not a hostname. Strip it back to the middle part.
• Using a wildcard. There is no *.myoxypages.com entry to make. Type the real subdomain.
• Renaming the subdomain later. The old name is released the moment you save a new one, and the hostname list still holds the dead address.
• Testing in the editor preview. Forms only submit on the published site, so the widget you are staring at may be on a page nobody has published.

When the hostname does not match, the widget refuses to render and the browser console reports error 110200, which Cloudflare documents as "add current domain in Hostname Management". That code is your answer in one line.

Where Do The Turnstile Keys Go In Form Settings?

Open your website's Forms page, then Form Settings. Choose Cloudflare Turnstile as the provider, paste the pair into the two fields (sitekey into Site Key, secret into Secret Key), and press Save Form Settings. From that moment your published forms accept submissions.

Two things are worth knowing about that screen:

• The Secret Key field behaves like a password box. It is verified server-side on every submission and never shown again after saving, so changing it means pasting the whole value in again.
• Saving replaces the previous pair outright. Switching providers later is the same action: pick the other provider, paste its pair, save.

Your page HTML never contains the secret. What gets added to your form when the page is served is a container element carrying a data-sitekey attribute, plus a script tag pointing at challenges.cloudflare.com. The secret travels only from the server to Cloudflare's siteverify endpoint, once per submission, and that call is what really decides whether an entry is accepted. The widget in the page is the polite half. The server check is the gate.

The Form Itself Stays Plain

Your page needs one attribute and nothing else. Here is a complete contact page: paste it in, publish it, and it starts accepting messages the moment the keys are saved.

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Contact Us</title>
  </head>
  <body>
    <h1>Contact Us</h1>

    <!-- Do not paste your Site Key or Secret Key into this file.
         The captcha widget is added automatically when the page is served. -->
    <form data-oxy-form="contact"
          data-oxy-success="Thanks. We reply within one working day.">
      <label for="name">Name</label>
      <input id="name" name="name" type="text" required>

      <label for="email">Email</label>
      <input id="email" name="email" type="email" required>

      <label for="message">Message</label>
      <textarea id="message" name="message" rows="5" required></textarea>

      <button type="submit">Send</button>
    </form>
  </body>
</html>

The data-oxy-success attribute is optional and only replaces the default "Message sent." text; there are more success and redirect options if you would rather send people to a thank-you page. Two rules apply to the fields: every input, select and textarea needs a name attribute or it is not captured, and file uploads are not supported.

What To Check When The Keys Do Not Work

Work down this table in order. Only two of these six symptoms are really about the site key and secret themselves.

One more limit is worth holding in mind while you test: each site also has a daily submission cap across all visitors, and it goes up with the plan, so the pricing page is the place to check yours. If entries are arriving but your inbox is silent, that is a notification question rather than a key question, and the form troubleshooting guide walks the rest of the causes in order.

Let AI Do It For You

Paste this into the Code Editor AI, or any coding agent, once the keys are saved.

Add a contact form to index.html for a site hosted on OxyPages.

Rules:
- Use a normal HTML form tag with the attribute data-oxy-form="contact".
- Give every input, select and textarea a name attribute, or the field
  is not captured.
- Include name, email and message fields, each with a label tied to it.
- Add data-oxy-success="Thanks. We reply within one working day." to the
  form tag.
- Do NOT add any captcha script, captcha div, sitekey or secret key to
  the page. The widget and the anti-spam honeypot are injected
  automatically when the page is served.
- Do NOT add a file input. File uploads are not supported.
- Match the existing styling of the page.

Then tell me, in one line, what I still have to do in Form Settings.

Once your Turnstile keys are saved, the rest is already built: entries land on your Forms page newest first, each site keeps a capped number of the most recent, and email notifications are a toggle rather than a service to wire up. Forms are on every plan, and the features page covers what else comes with them.