Pre-Clearance support

You can integrate Cloudflare challenges on single-page applications (SPAs) by allowing Turnstile to issue a Pre-Clearance cookie. The Pre-Clearance level is set upon widget creation or widget modification using the Turnstile API’s clearance_level. Possible values for the configuration are no_clearance, jschallenge, managed, or interactive. All widgets are set to no_clearance by default.

For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing Pre-Clearance cookies on widgets where at least one domain is specified.

Note

Pre-Clearance cookies only support zones that are orange-clouded.

Refer to the blog post ↗ for an example of Pre-Clearance implementation.

Pre-Clearance level options

• Interactive: Interactive Pre-Clearance allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
• Managed: Managed allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
• Non-interactive: Non-interactive allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules

Duration

Clearance cookies generated by the Turnstile widget will be valid for the time specified by the zone-level Challenge Passage value. To configure the Challenge Passage setting, refer to the WAF documentation.

Enable Pre-Clearance on a new site

1. Log in to the Cloudflare dashboard ↗ and select your account.
2. Go to Turnstile > Add Site.
3. Under Would you like to opt for Pre-Clearance for this site? select Yes.
4. Choose the Pre-Clearance level from the select box.
5. Select Create.

Enable Pre-Clearance on an existing site

1. Log in to the Cloudflare dashboard ↗ and select your account.
2. Go to Turnstile.
3. Go to the existing widget or site and select Settings.
4. Under Would you like to opt for Pre-Clearance for this site? select Yes.
5. Choose the Pre-Clearance level from the select box.
6. Select Update.

Verified bots

If a verified bot encounters a page where a Turnstile widget is implemented, the challenge will fail and the verified bot will see a 403 error from the Turnstile endpoint.

However, if a verified bot is excluded from the rule which pre-clearance will grant clearance for, it will pass. Users can create a WAF custom rule to exclude verified bots.