Cloudflare Turnstile in Playwright tests: what test keys cover and when you need real keys
Put a Cloudflare Turnstile widget on a signup form and your Playwright suite will start failing in ways that have nothing to do with your code. Cloudflare's own testing docs say it directly: automated suites such as Selenium, Cypress and Playwright are detected as bots. The widget may block, show a challenge, or behave differently from run to run. Cloudflare's answer is a set of dummy keys. They…
Cloudflare's Turnstile widget can cause issues in automated Playwright tests, such as Selenium, Cypress, and Playwright, as these are detected as bots. To solve this problem, Cloudflare provides dummy keys that can help most of the time. However, there are certain checks that require real keys.
A Playwright setup can be configured to use test keys by entering them into environment variables. Playwright's webServer option can be used to start the application before running tests and accept environment blocks, allowing tests to run with test keys.
There are four pairs of test keys provided by Cloudflare: one for always passing, one for always failing, one for passing/failing invisible widgets, and one for forcing an interactive challenge. The test sitekeys produce a dummy token XXXX.DUMMY.TOKEN.XXXX, which only passes with the production secret keys.
When using test keys, it's essential to cover different scenarios, including the form showing a useful message, keeping the user's input, and offering a retry when the widget fails. Another scenario is when the server rejects the form, indicating that the backend checks the success instead of relying on the token. Lastly, there's the interactive challenge, which is useful for manual checks when the challenge appears, but should be excluded from CI runs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
