If you own the application, use Cloudflare’s test sitekeys and matching test secret keys in a non-production environment. They let browser automation exercise success, failure, and interactive-challenge flows without relying on production challenges. Cloudflare does not support Selenium, Puppeteer, Playwright, or Cypress for solving production challenges; its documented testing route is test credentials. Cloudflare’s testing guide and supported browsers guidance describe those boundaries.
What “bypass” should mean in an authorized test
For an application you control, bypassing Turnstile in end-to-end tests should mean replacing the production challenge with Cloudflare’s deterministic test configuration—not teaching automation to defeat a live protection. Cloudflare notes that automated suites such as Selenium, Cypress, and Playwright may be detected as bots. It also says browser automation frameworks, including Selenium, Puppeteer, Playwright, and Cypress, are not supported for solving production challenges.
As an Amazon Associate I earn from qualifying purchases.
Use separate test and production credentials. A test sitekey is public and renders the widget in the browser; its matching secret key belongs on the server that validates tokens. Cloudflare warns that production secret keys reject dummy test tokens, so the test sitekey and test secret must be used together.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set up deterministic Turnstile tests
- Create an isolated test configuration. Use Cloudflare’s published test sitekey and corresponding test secret in a development or test environment. Keep the production sitekey and secret in production-only configuration.
- Render the test widget through your normal form. Point the application’s existing widget integration at the test sitekey. Let the browser test interact with the page as it normally would; do not replace the application flow with a mocked client-side success.
- Validate the token on your server. Send the token to Cloudflare’s Siteverify API using the matching test secret. A widget displayed in the browser, by itself, is not server-side verification.
- Exercise the expected outcomes. Cover successful submission, rejected validation, an already-used token, and an interactive challenge where relevant to the widget configuration.
- Block test credentials from release. Add a deployment check that fails if test keys are configured for a production build, and verify that production receives its actual sitekey and secret.
Cloudflare lists these test sitekeys for visible and invisible widgets:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Test scenario | Sitekey | Expected behavior |
|---|---|---|
| Visible, always passes | 1x00000000000000000000AA |
Success |
| Visible, always fails | 2x00000000000000000000AB |
Failure |
| Invisible, always passes | 1x00000000000000000000BB |
Success |
| Invisible, always fails | 2x00000000000000000000BB |
Failure |
| Visible, forces an interactive challenge | 3x00000000000000000000FF |
Interactive challenge path |
Cloudflare also publishes matching test secret keys for always-pass, always-fail, and token-already-spent validation behavior. Because these credentials are product documentation and may change, retrieve the current values from the official testing page rather than copying a secret into a public code sample.
Choose test cases for the widget type
Cloudflare documents Managed, Non-interactive, and Invisible widget types. The right test cases depend on the interaction your application actually enables; no type is universally best.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
| Widget type | What to verify in your application |
|---|---|
| Managed | Test the ordinary form path and any interaction or failure handling the configured widget can present. |
| Non-interactive | Test form success and validation failure without assuming a user-operated challenge is part of every run. |
| Invisible | Test the background verification path and ensure submission errors remain clear when validation fails. |
Use the documented pass and fail test keys to make outcomes predictable. Include the interactive test key when you need to verify the user-facing challenge path. Do not infer production challenge behavior from a test-key run.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsKeep production validation and test safety intact
Verify every production token server-side
In production, the widget generates a token in the visitor’s browser, but your application server must submit it to Cloudflare’s Siteverify API. Do not treat the presence of a client-side widget or a returned browser token as proof of verification. Keep the secret key out of browser code and client-visible bundles.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Account for expiry and single use
Cloudflare states that Turnstile tokens expire 300 seconds after generation and can be validated only once. Expired or replayed tokens are rejected. Your application should handle rejected verification by asking for a fresh challenge or allowing the user to retry through the normal flow, rather than reusing a stale token.
Separate credentials by environment
- Store test sitekey and secret only in non-production configuration.
- Store production sitekey and secret separately, with the secret available only to the server.
- Check the selected keys during deployment so a test configuration cannot ship accidentally.
- Never use a test secret to validate production traffic or a production secret to validate dummy test tokens.
Cloudflare’s E2E testing guidance discusses environment detection, separate credentials, and deployment safeguards.
Rank #4
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Troubleshoot failing or flaky browser tests
- Automation is flagged as a bot or the test is inconsistent: The test may be using production credentials or depending on a live challenge outcome. Switch the non-production run to the documented test sitekey and its matching secret.
- A dummy token is rejected: Confirm that the server is using the test secret paired with the test sitekey. Cloudflare production secrets reject dummy test tokens.
- A previously successful token now fails: Tokens are single-use and expire after 300 seconds. Request a new token for each validation attempt and avoid reusing a token across retries.
- The interactive case never appears: Confirm that the test uses the visible interactive test sitekey,
3x00000000000000000000FF, and that the test actually reaches the widget’s challenge path. - Production behaves differently from the test environment: Test credentials provide deterministic scenarios; they do not establish that automation can solve production challenges. Validate production through server-side Siteverify and normal user flows.
- Test credentials appear in a release: Stop deployment, correct the environment configuration, and rotate exposed secrets if necessary. Add a build or deployment assertion to prevent a repeat.
Or skip the browser setup
For ordinary website screenshots—not testing or bypassing Turnstile—ScreenshotNeo offers a one-request screenshot API. It accepts and removes cookie/consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, failed loads, timeouts, and cache hits are not billed. Its response identifies the page verdict and billing status. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents.
Example cURL request:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Sign up for free ScreenshotNeo access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
