docs: point CAPTCHA integrations to built-in Turnstile support

enterprise-sso/okta/ory-console-steps.md

@@ -1,6 +1,6 @@
 # Okta — Ory Console setup steps
 
-This is the manual setup flow for adding Okta as an OIDC social-signin provider to an Ory Network project. The full walkthrough with screenshots lives at [ory.com/docs/integrations/okta](https://ory.com/docs/integrations/okta).
+This is the manual setup flow for adding Okta as an OIDC social-signin provider to an Ory Network project. The full walkthrough with screenshots lives at [ory.com/docs/integrates-with/enterprise-sso/okta](https://www.ory.com/docs/integrates-with/enterprise-sso/okta).
 
 ## 1. Create the Okta application
 

fraud-bot-protection/arkose-labs/README.md

@@ -7,6 +7,8 @@
 **Type:** webhook (Ory Action verifies the Arkose token from the client) — code lives in customer's webhook handler
 **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs](https://www.ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs)
 
+> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need Arkose Labs specifically.
+
 ## How it works
 
 1. Your registration / login UI embeds the **Arkose Labs client SDK**; the SDK runs scoring + a challenge if needed and returns a one-time token.

fraud-bot-protection/arkose-labs/registry.entry.yaml

@@ -21,6 +21,7 @@ coreFunctionality: |-
   - Use a per-flow token (don't reuse across registration and login).
   - Adaptive challenges escalate per-risk; pick challenge type per-flow risk profile via Arkose's game configuration.
   - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs.
+  - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need Arkose Labs specifically.
 oryMechanism:
   - actions
 protocol:

fraud-bot-protection/cloudflare-turnstile/README.md

@@ -7,6 +7,8 @@
 **Type:** webhook (Ory Action verifies the Turnstile token from the client) — code in customer's webhook handler
 **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile](https://www.ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile)
 
+> **Built-in alternative:** Ory Kratos Identities supports Cloudflare Turnstile natively. Turn on [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) in your project instead of building and hosting this webhook.
+
 ## How it works
 
 1. Your registration / login UI embeds the **Turnstile client widget**; the widget runs the challenge invisibly and returns a token (`cf-turnstile-response`).
@@ -34,7 +36,7 @@
 
 ## Status
 
-Community / proposed — no dedicated Ory documentation. Same pattern as hCaptcha / reCAPTCHA / Arkose.
+Community / proposed. Superseded by Ory's [built-in Turnstile support](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use that instead.
 
 ## License
 

fraud-bot-protection/cloudflare-turnstile/registry.entry.yaml

@@ -21,6 +21,7 @@ coreFunctionality: |-
   - Free with no per-call limit — practical default for new projects.
   - Optional remoteip field in siteverify enables IP-binding check; pass the client IP through the reverse proxy.
   - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile; same pattern as hCaptcha / reCAPTCHA / Arkose.
+  - Built-in alternative: Ory Kratos Identities supports Turnstile natively (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); turn on built-in CAPTCHA protection instead of building and hosting this webhook.
 oryMechanism:
   - actions
 protocol:

fraud-bot-protection/hcaptcha/README.md

@@ -7,6 +7,8 @@
 **Type:** webhook (Ory Action verifies the hCaptcha token from the client) — code in customer's webhook handler
 **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha](https://www.ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha)
 
+> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need hCaptcha specifically.
+
 ## How it works
 
 1. Your registration / login UI embeds the **hCaptcha client widget**; the widget runs the challenge and returns a token (`h-captcha-response`).

fraud-bot-protection/hcaptcha/registry.entry.yaml

@@ -22,6 +22,7 @@ coreFunctionality: |-
   - hCaptcha API contract is nearly identical to reCAPTCHA — easy migration between the two.
   - Enterprise tier adds adaptive risk scoring and invisible challenges; verify endpoint shape unchanged.
   - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha; same pattern as Turnstile / reCAPTCHA / Arkose.
+  - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need hCaptcha specifically.
 oryMechanism:
   - actions
 protocol:

fraud-bot-protection/recaptcha/README.md

@@ -7,6 +7,8 @@
 **Type:** webhook (Ory Action calls a handler during a flow)
 **Docs page:** [ory.com/docs/integrates-with/fraud-bot-protection/recaptcha](https://www.ory.com/docs/integrates-with/fraud-bot-protection/recaptcha)
 
+> **Built-in alternative:** Ory Kratos Identities has [built-in CAPTCHA protection](https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA) based on Cloudflare Turnstile, with no webhook to build or host. Use it unless you need reCAPTCHA specifically.
+
 ## Use case
 
 A consumer-facing product wants to stop bot signups and credential-stuffing attempts without enrolling in Cloudflare Turnstile. The team already has Google reCAPTCHA on its marketing site and wants the same protection on Ory-hosted registration and login flows. This integration runs as a sync webhook on the `after` trigger that interrupts the flow before any identity is created or session is issued if the reCAPTCHA token is missing, invalid, or scores below the configured threshold.

fraud-bot-protection/recaptcha/registry.entry.yaml

@@ -23,6 +23,7 @@ coreFunctionality: |-
   - For v2 returns pass on success: true; for v3 also enforces RECAPTCHA_SCORE_THRESHOLD and optional RECAPTCHA_EXPECTED_ACTION.
   - Returns 400 + a flow-level error message ("CAPTCHA verification failed") to interrupt the flow, or 200 + empty body to let it proceed.
   - Fails closed on a siteverify outage so a Google-API hiccup doesn't silently disable bot protection.
+  - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need reCAPTCHA specifically.
 oryMechanism:
   - actions
 protocol:

registry.yaml

@@ -8,7 +8,7 @@ apiVersion: ory.com/integrations-v1
 kind: Registry
 metadata:
   name: ory-integrates
-  generated: 2026-08-31T14:26:35Z
+  generated: 2026-10-06T15:31:37Z
 integrations:
   - name: skyfire
     displayName: Skyfire
@@ -1758,6 +1758,7 @@ integrations:
       - Use a per-flow token (don't reuse across registration and login).
       - Adaptive challenges escalate per-risk; pick challenge type per-flow risk profile via Arkose's game configuration.
       - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/arkose-labs.
+      - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need Arkose Labs specifically.
     oryMechanism:
       - actions
     protocol:
@@ -1811,6 +1812,7 @@ integrations:
       - Free with no per-call limit — practical default for new projects.
       - Optional remoteip field in siteverify enables IP-binding check; pass the client IP through the reverse proxy.
       - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/cloudflare-turnstile; same pattern as hCaptcha / reCAPTCHA / Arkose.
+      - Built-in alternative: Ory Kratos Identities supports Turnstile natively (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); turn on built-in CAPTCHA protection instead of building and hosting this webhook.
     oryMechanism:
       - actions
     protocol:
@@ -1838,6 +1840,7 @@ integrations:
       - hCaptcha API contract is nearly identical to reCAPTCHA — easy migration between the two.
       - Enterprise tier adds adaptive risk scoring and invisible challenges; verify endpoint shape unchanged.
       - Status: community/proposed — documented at ory.com/docs/integrates-with/fraud-bot-protection/hcaptcha; same pattern as Turnstile / reCAPTCHA / Arkose.
+      - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need hCaptcha specifically.
     oryMechanism:
       - actions
     protocol:
@@ -1866,6 +1869,7 @@ integrations:
       - For v2 returns pass on success: true; for v3 also enforces RECAPTCHA_SCORE_THRESHOLD and optional RECAPTCHA_EXPECTED_ACTION.
       - Returns 400 + a flow-level error message ("CAPTCHA verification failed") to interrupt the flow, or 200 + empty body to let it proceed.
       - Fails closed on a siteverify outage so a Google-API hiccup doesn't silently disable bot protection.
+      - Built-in alternative: Ory Kratos Identities has native CAPTCHA protection based on Cloudflare Turnstile (https://www.ory.com/docs/kratos/self-service/flows/CAPTCHA); use it unless you need reCAPTCHA specifically.
     oryMechanism:
       - actions
     protocol: