[Turnstile] Undocumented response fields: tokenId, result_with_testing_key

[eherot]

Existing documentation URL(s)

https://developers.cloudflare.com/turnstile/get-started/server-side-validation/#api-response-format

What changes are you suggesting?

The response sometimes includes fields that are not described in the documentation:

• tokenId (when there is an error)
• result_with_testing_key (when used in test mode)

Additional information

No response

[elithrar]

/bonk can you validate this against the Turnstile API and user reports?

POST https://challenges.cloudflare.com/turnstile/v0/siteverify

[ask-bonk]

Created PR #28259

github run

[punkeel]

Thank you for taking the time to report this @eherot!

Our documentation intentionally covers only the request and response fields that we formally commit to supporting and that we want developers to rely on in their integrations. As a general principle, API consumers should ensure their implementations tolerate additional response fields without breaking.

Some additional fields, such as result_with_testing_key, may appear in responses to help users (and Cloudflare staff) spot check and troubleshoot issues when reviewing logged responses.

For server-side validation, integrations should focus primarily on the success=true indicator rather than relying on other fields. We do not plan to document the two fields you mentioned at this time. That said, we appreciate you flagging the tokenId behavior and will review it internally.