Embed bot protection (Cloudflare Turnstile)

For public embed chat, you can optionally enable Cloudflare Turnstile, a bot challenge that runs in the visitor's browser before messages are accepted. Turnstile is opt-in per embed widget and uses your Cloudflare site key and secret key (bring your own keys).

Independence & cost: Cloudflare does not sponsor Integrava. Integrava does not provide, host, or pay for Turnstile on your behalf. You create a free Cloudflare account, own the Turnstile widget, and any free-tier quotas or billing are between you and Cloudflare. There is no extra Integrava charge for enabling this option.

When you enable Turnstile on a widget and save both keys, the embed requests a short-lived challenge token before each chat send. Integrava verifies that token on the server using your secret key. Visitors usually do not see a CAPTCHA puzzle (invisible mode).

If Turnstile is off (the default), chat works without a challenge — rate limits and allowed domains still apply.

The challenge runs on the page that hosts your widget (for example shop.acme.com), not on integrava.ai. Allowlist those same hosts in both Embed assistant and your Cloudflare Turnstile widget.

Allowed domains alone are not enough against non-browser scripts that spoof headers. Turnstile closes that gap when you choose to enable it.

1. Create a Cloudflare Turnstile widget

   Sign up or sign in at dash.cloudflare.com. Open Turnstile → Add widget. Set Domains to every hostname that will load your embed (same as allowed domains below). Mode: Invisible (recommended) or Managed. Copy the Site Key and Secret Key.

2. Create or open your Integrava widget

   Go to Embed assistant. Create a widget (or edit an existing one).

3. List every hostname that will load the widget

   In the widget's allowed domains field, add one host per line — for example:

   www.yourshop.com
   yourshop.com
   help.yourshop.com
   localhost

   • Use the hostname visitors see in the browser address bar (no https://, no path).
   • Include www and non-www if both serve the widget.
   • Add localhost only for local development — and add it to your Cloudflare Turnstile domains too if you test locally.
   • Do not list integrava.ai unless you actually host a demo page there.
4. Paste keys and enable Turnstile

   In Embed assistant, under Cloudflare Turnstile, paste your site key and secret key, check Enable Cloudflare Turnstile, then Save Turnstile. The secret is stored encrypted and is never shown again (you will see “Secret saved”).

5. Paste the snippet and test

   Place the embed snippet only on pages on those hosts. Send a test message from a listed domain. If chat works and messages reach Conversations, you are set. The widget handles the challenge automatically — you do not add a separate CAPTCHA script.

   <script
     src="https://YOUR_API_HOST/widget.js"
     data-widget-token="YOUR_WIDGET_TOKEN"
   ></script>

6. Keep domains in sync

   When you launch a new domain, add it to Embed allowed domains and to your Cloudflare Turnstile widget domains before shipping the snippet there.

Putting your marketing or app site behind Cloudflare (CDN, WAF, or additional Turnstile on other forms) is entirely separate from Integrava embed Turnstile. You can use Turnstile for the embed without proxying your whole site through Cloudflare.

• “Security check failed” — Turnstile is enabled but the challenge failed. Confirm site/secret keys match your Cloudflare widget, and that the page hostname is allowlisted in Cloudflare Turnstile domains.
• Turnstile enabled but not configured — save both site key and secret before enabling, or turn the toggle off.
• Chat fails only on a new domain — add that hostname to Embed allowed domains and to your Cloudflare Turnstile widget domains.
• Works on localhost but not production — production hosts must be listed in both places; localhost does not cover them.
• Messages never appear in Conversations — confirm the widget is enabled, the snippet uses the correct token, and AI / knowledge is configured under /settings.

Developer identify tokens and webhooks: Integrations → SDK & embed guide (sign-in required). Broader channel setup: Setup & platform guide → Customer channels.