From c16ef0c6a6beb44fb6725eca7516b4e22ba4f9d4 Mon Sep 17 00:00:00 2001 From: jhickmanit Date: Tue, 6 Oct 2026 09:37:14 -0700 Subject: [PATCH 1/2] docs: point CAPTCHA integrations to built-in Turnstile support Add a built-in alternative callout to the Cloudflare Turnstile, hCaptcha, reCAPTCHA, and Arkose Labs READMEs and registry entries, mark the Turnstile webhook as superseded, and regenerate registry.yaml. --- fraud-bot-protection/arkose-labs/README.md | 2 ++ fraud-bot-protection/arkose-labs/registry.entry.yaml | 1 + fraud-bot-protection/cloudflare-turnstile/README.md | 4 +++- .../cloudflare-turnstile/registry.entry.yaml | 1 + fraud-bot-protection/hcaptcha/README.md | 2 ++ fraud-bot-protection/hcaptcha/registry.entry.yaml | 1 + fraud-bot-protection/recaptcha/README.md | 2 ++ fraud-bot-protection/recaptcha/registry.entry.yaml | 1 + registry.yaml | 6 +++++- 9 files changed, 18 insertions(+), 2 deletions(-) diff --git a/fraud-bot-protection/arkose-labs/README.md b/fraud-bot-protection/arkose-labs/README.md index aa7d3e6..c19397a 100644 --- a/fraud-bot-protection/arkose-labs/README.md +++ b/fraud-bot-protection/arkose-labs/README.md @@ -7,6 +7,8 @@ **Type:** webhook (Ory Action verifies the Arkose token from the client) — code lives in customer's webhook handler **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs](https://www.ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs) +> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need Arkose Labs specifically. + ## How it works 1. Your registration / login UI embeds the **Arkose Labs client SDK**; the SDK runs scoring + a challenge if needed and returns a one-time token. diff --git a/fraud-bot-protection/arkose-labs/registry.entry.yaml b/fraud-bot-protection/arkose-labs/registry.entry.yaml index 32b6ecb..6ed4ef7 100644 --- a/fraud-bot-protection/arkose-labs/registry.entry.yaml +++ b/fraud-bot-protection/arkose-labs/registry.entry.yaml @@ -21,6 +21,7 @@ coreFunctionality: |- - Use a per-flow token (don't reuse across registration and login). - Adaptive challenges escalate per-risk; pick challenge type per-flow risk profile via Arkose's game configuration. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need Arkose Labs specifically. oryMechanism: - actions protocol: diff --git a/fraud-bot-protection/cloudflare-turnstile/README.md b/fraud-bot-protection/cloudflare-turnstile/README.md index ef35906..92b42f5 100644 --- a/fraud-bot-protection/cloudflare-turnstile/README.md +++ b/fraud-bot-protection/cloudflare-turnstile/README.md @@ -7,6 +7,8 @@ **Type:** webhook (Ory Action verifies the Turnstile token from the client) — code in customer's webhook handler **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile](https://www.ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile) +> **Built-in alternative:** Ory Kratos Identities supports Cloudflare Turnstile natively. Turn on [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) in your project instead of building and hosting this webhook. + ## How it works 1. Your registration / login UI embeds the **Turnstile client widget**; the widget runs the challenge invisibly and returns a token (`cf-turnstile-response`). @@ -34,7 +36,7 @@ ## Status -Community / proposed — no dedicated Ory documentation. Same pattern as hCaptcha / reCAPTCHA / Arkose. +Community / proposed. Superseded by Ory's [built-in Turnstile support](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use that instead. ## License diff --git a/fraud-bot-protection/cloudflare-turnstile/registry.entry.yaml b/fraud-bot-protection/cloudflare-turnstile/registry.entry.yaml index daff3aa..da50932 100644 --- a/fraud-bot-protection/cloudflare-turnstile/registry.entry.yaml +++ b/fraud-bot-protection/cloudflare-turnstile/registry.entry.yaml @@ -21,6 +21,7 @@ coreFunctionality: |- - Free with no per-call limit — practical default for new projects. - Optional remoteip field in siteverify enables IP-binding check; pass the client IP through the reverse proxy. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile; same pattern as hCaptcha / reCAPTCHA / Arkose. + - Built-in alternative: Ory Kratos Identities supports Turnstile natively (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); turn on built-in CAPTCHA protection instead of building and hosting this webhook. oryMechanism: - actions protocol: diff --git a/fraud-bot-protection/hcaptcha/README.md b/fraud-bot-protection/hcaptcha/README.md index 40bef05..b6ea6a7 100644 --- a/fraud-bot-protection/hcaptcha/README.md +++ b/fraud-bot-protection/hcaptcha/README.md @@ -7,6 +7,8 @@ **Type:** webhook (Ory Action verifies the hCaptcha token from the client) — code in customer's webhook handler **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha](https://www.ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha) +> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need hCaptcha specifically. + ## How it works 1. Your registration / login UI embeds the **hCaptcha client widget**; the widget runs the challenge and returns a token (`h-captcha-response`). diff --git a/fraud-bot-protection/hcaptcha/registry.entry.yaml b/fraud-bot-protection/hcaptcha/registry.entry.yaml index d3c82f9..f79aabe 100644 --- a/fraud-bot-protection/hcaptcha/registry.entry.yaml +++ b/fraud-bot-protection/hcaptcha/registry.entry.yaml @@ -22,6 +22,7 @@ coreFunctionality: |- - hCaptcha API contract is nearly identical to reCAPTCHA — easy migration between the two. - Enterprise tier adds adaptive risk scoring and invisible challenges; verify endpoint shape unchanged. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha; same pattern as Turnstile / reCAPTCHA / Arkose. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need hCaptcha specifically. oryMechanism: - actions protocol: diff --git a/fraud-bot-protection/recaptcha/README.md b/fraud-bot-protection/recaptcha/README.md index 4ce9706..a7b9451 100644 --- a/fraud-bot-protection/recaptcha/README.md +++ b/fraud-bot-protection/recaptcha/README.md @@ -7,6 +7,8 @@ **Type:** webhook (Ory Action calls a handler during a flow) **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/recaptcha](https://www.ory.com/docs/integrates-with/fraud-bot-protection/recaptcha) +> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need reCAPTCHA specifically. + ## Use case A consumer-facing product wants to stop bot signups and credential-stuffing attempts without enrolling in Cloudflare Turnstile. The team already has Google reCAPTCHA on its marketing site and wants the same protection on Ory-hosted registration and login flows. This integration runs as a sync webhook on the `after` trigger that interrupts the flow before any identity is created or session is issued if the reCAPTCHA token is missing, invalid, or scores below the configured threshold. diff --git a/fraud-bot-protection/recaptcha/registry.entry.yaml b/fraud-bot-protection/recaptcha/registry.entry.yaml index 39d9d37..3f4558c 100644 --- a/fraud-bot-protection/recaptcha/registry.entry.yaml +++ b/fraud-bot-protection/recaptcha/registry.entry.yaml @@ -23,6 +23,7 @@ coreFunctionality: |- - For v2 returns pass on success: true; for v3 also enforces RECAPTCHA_SCORE_THRESHOLD and optional RECAPTCHA_EXPECTED_ACTION. - Returns 400 + a flow-level error message ("CAPTCHA verification failed") to interrupt the flow, or 200 + empty body to let it proceed. - Fails closed on a siteverify outage so a Google-API hiccup doesn't silently disable bot protection. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need reCAPTCHA specifically. oryMechanism: - actions protocol: diff --git a/registry.yaml b/registry.yaml index e95f115..b5191e6 100644 --- a/registry.yaml +++ b/registry.yaml @@ -8,7 +8,7 @@ apiVersion: ory.com/integrations-v1 kind: Registry metadata: name: ory-integrates - generated: 2026-08-31T14:26:35Z + generated: 2026-10-06T15:31:37Z integrations: - name: skyfire displayName: Skyfire @@ -1758,6 +1758,7 @@ integrations: - Use a per-flow token (don't reuse across registration and login). - Adaptive challenges escalate per-risk; pick challenge type per-flow risk profile via Arkose's game configuration. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need Arkose Labs specifically. oryMechanism: - actions protocol: @@ -1811,6 +1812,7 @@ integrations: - Free with no per-call limit — practical default for new projects. - Optional remoteip field in siteverify enables IP-binding check; pass the client IP through the reverse proxy. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile; same pattern as hCaptcha / reCAPTCHA / Arkose. + - Built-in alternative: Ory Kratos Identities supports Turnstile natively (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); turn on built-in CAPTCHA protection instead of building and hosting this webhook. oryMechanism: - actions protocol: @@ -1838,6 +1840,7 @@ integrations: - hCaptcha API contract is nearly identical to reCAPTCHA — easy migration between the two. - Enterprise tier adds adaptive risk scoring and invisible challenges; verify endpoint shape unchanged. - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha; same pattern as Turnstile / reCAPTCHA / Arkose. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need hCaptcha specifically. oryMechanism: - actions protocol: @@ -1866,6 +1869,7 @@ integrations: - For v2 returns pass on success: true; for v3 also enforces RECAPTCHA_SCORE_THRESHOLD and optional RECAPTCHA_EXPECTED_ACTION. - Returns 400 + a flow-level error message ("CAPTCHA verification failed") to interrupt the flow, or 200 + empty body to let it proceed. - Fails closed on a siteverify outage so a Google-API hiccup doesn't silently disable bot protection. + - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need reCAPTCHA specifically. oryMechanism: - actions protocol: From d72d8a20b4e06f3aea856d538eb123ca9425477e Mon Sep 17 00:00:00 2001 From: jhickmanit Date: Tue, 6 Oct 2026 09:37:14 -0700 Subject: [PATCH 2/2] fix: correct Okta console-steps docs link --- enterprise-sso/okta/ory-console-steps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/enterprise-sso/okta/ory-console-steps.md b/enterprise-sso/okta/ory-console-steps.md index a46b091..d64c793 100644 --- a/enterprise-sso/okta/ory-console-steps.md +++ b/enterprise-sso/okta/ory-console-steps.md @@ -1,6 +1,6 @@ # Okta — Ory Console setup steps -This is the manual setup flow for adding Okta as an OIDC social-signin provider to an Ory Network project. The full walkthrough with screenshots lives at [ory.com/docs/integrations/okta](https://ory.com/docs/integrations/okta). +This is the manual setup flow for adding Okta as an OIDC social-signin provider to an Ory Network project. The full walkthrough with screenshots lives at [ory.com/docs/integrates-with/enterprise-sso/okta](https://www.ory.com/docs/integrates-with/enterprise-sso/okta). ## 1. Create the Okta application