Human verification for the unauthenticated browser forms, via Cloudflare Turnstile.

Off by default. It guards the two paths that mail an address the submitter chose — registration and the magic link — where the abuse is not "too many requests from one IP" (the rate limiter in GamendWeb.LiveHelpers already answers that) but a botnet spending our mail reputation an address at a time. Password login is deliberately not guarded: a captcha on every routine sign-in is friction for returning players, and the credentials are their own proof.

POST /api/v1/register mails an address too, but a game client often has no browser to render the widget in, so turning the forms' captcha on leaves it alone. api_register puts it in front of the endpoint as well: the client then sends a Turnstile token as captcha_token, from a web export or a webview. Device login is never guarded.

Setup

Create a widget at https://dash.cloudflare.com/?to=/:account/turnstile — it is free with no request cap and no card — then set:

GAMEND_CAPTCHA_ENABLED=true
GAMEND_CAPTCHA_SITE_KEY=0x4AAA...
GAMEND_CAPTCHA_SECRET_KEY=0x4AAA...

Dev and test need none of that: with the keys unset we fall back to Cloudflare's published dummy pair, which passes on any host including localhost. That keeps the widget on the page in development, so a form that only breaks once a captcha is in front of it breaks on the developer's machine rather than in production. To exercise the failure path, set GAMEND_CAPTCHA_SECRET_KEY to the always-fails dummy, 2x0000000000000000000000000000000AA.