Turnstile siteverify error "timeout-or-duplicate" or "invalid-input-response"

What does the siteverify response look like when it fails?

Siteverify always answers with JSON. On failure, success is false and error-codes lists why. Cloudflare documents these codes: missing-input-secret (secret parameter not provided), invalid-input-secret (secret key is invalid or expired), missing-input-response (response parameter was not provided), invalid-input-response (token is invalid, malformed, or expired), bad-request (request is malformed), timeout-or-duplicate (token has already been validated) and internal-error (retry the request). The two secret codes point at the key in your Vercel project, not at the visitor's token.

{"success": false, "error-codes": ["timeout-or-duplicate"]}

Why does the token fail when my form only submits once?

Look for a second place that validates the same token: a retry loop around the fetch to siteverify, a check in middleware as well as in the route, or Supabase Auth. When CAPTCHA protection is on in a Supabase project, Auth sends the token you pass as captchaToken to the provider siteverify endpoint itself (supabase/auth, internal/security/captcha.go). If your route already validated that token, Auth gets timeout-or-duplicate and puts it in its error message; see the Supabase captcha_token page. Pick one verifier: turn on Supabase CAPTCHA and pass the token to supabase-js, or verify in your own route and leave Supabase CAPTCHA off.

What does a Next.js route that verifies once look like?

Inside a form the widget adds a hidden input named cf-turnstile-response, and its token travels with your other fields. Send it to your route and validate it with the secret. Do not call siteverify from the browser: Cloudflare says your server must validate every token. For a retry of the same validation request after a network error, Cloudflare describes idempotency_key as a UUID you generate to safely retry validation requests.

export async function POST(req: Request) {
  const { token } = await req.json();
  const res = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: token }),
  });
  const data = await res.json();
  if (!data.success) {
    console.error("turnstile", data["error-codes"]);
    return Response.json({ error: "captcha_failed" }, { status: 400 });
  }
  // create the user here
  return Response.json({ ok: true });
}

Checklist

How to fix it, then check the fix

1. 01
   Find a Turnstile secret the repo never documents. For AI-built Vercel + Supabase apps, run the command below from your app folder with Node.js 20 or newer. When code reads process.env.TURNSTILE_SECRET_KEY and .env.example does not list it, it reports env_var_drift as a warning, but it cannot see the variables set in your Vercel project, so it cannot tell whether the secret is set there for Production and Preview. It is a repository check, not a live database test: it does not run your app or call Cloudflare, so it cannot tell whether a token is valid. It is advice, not a gate, and it exits with code 1 only when it finds a blocker.

   npx -y viberaven@1.7.1 check

2. 02
   Log the error codes from siteverify, so the real code shows in the Vercel function logs:

   console.error("turnstile", data["error-codes"]);

3. 03
   Find every place that validates a token:

   grep -rnE "siteverify|captchaToken" --exclude-dir=node_modules --exclude-dir=.next .

4. 04Keep one verification per submission. Do not repeat it in middleware, in a retry loop, or after Supabase Auth has already verified the same token.
5. 05Reset the widget after every attempt, success or failure: explicit widgets call turnstile.reset(widgetId). Cloudflare says a token expires after 300 seconds and can be validated once.
6. 06
   If the codes are missing-input-secret or invalid-input-secret, set the secret key from the Cloudflare dashboard in Vercel for Production and Preview, then redeploy:

   vercel env add TURNSTILE_SECRET_KEY production
   vercel env add TURNSTILE_SECRET_KEY preview

7. 07Submit the form once on the deployed site: the route answers ok. Replaying the same request body then returns timeout-or-duplicate, which shows the token is single use and the check reaches Cloudflare.

Related

Related guides

• VercelWhich env vars does my app read that are missing in Vercel production?Guide
• Do my Next.js API routes have rate limiting, and how do I check?Guide
• VercelUpstashHow do I add Upstash rate limiting to a Next.js API route on Vercel?Guide

Sources

Official docs behind this checklist

• Cloudflare Turnstile, Server-side validation (siteverify, error codes)
• Cloudflare Turnstile, Client-side rendering (cf-turnstile-response, reset)
• Cloudflare Turnstile, Client-side error codes
• Supabase, Enable CAPTCHA protection
• supabase/auth, internal/security/captcha.go

FAQ

FAQ for builders before launch