Interesting that both the client side API and server side API for Cloudflare's turnstile seem to match Google's reCAPTCHA nearly exactly, which works in pretty much the same way with the exception that you can't configure it to _never_ show a visual captcha (in rare cases the v2 Invisible reCAPTCHA will still show the "select all the X from the images below" dialog)

Even down to the API endpoint and JS API names.

  https://www.google.com/recaptcha/api/siteverify
  https://challenges.cloudflare.com/turnstile/v0/siteverify

  grecaptcha.render({ callback: function (token) { ... } });
  turnstile.render({ callback: function (token) { ... } });

As soon as I saw the examples I recognised the names, I guess it's designed to be a drop in replacement?

https://developers.google.com/recaptcha/docs/verify https://developers.google.com/recaptcha/docs/invisible