Learn how to securely validate Turnstile tokens on your server using the Siteverify API. Mandatory server-side validation You must call the Siteverify API to complete your Turnstile implementation.

Prompt injection is the #1 risk on the OWASP LLM Top 10, and most agents in production today defend against it with one of two heuristics: a defensive system prompt, or a hand-rolled allow-list.