Siteverify returns 'timeout-or-duplicate' for fresh 'cf-turnstile-response'

I have a standard implicit implementation in the browser which successfully verifies the user and sets a new unique ‘cf-turnstile-response’ value as expected.

On the server-side, I have a standard express implementation sending the ‘cf-turnstile-response’ to the siteverify endpoint.

Other than sitekeys and secrets, client and server implementation matches ‘Turnstile Getting Started’ exactly. (Copy Paste, refactor)

My turnstile site configuration is set up with 2 sites, one authorizes ‘localhost’ the other authorizes my domain (prod).

When I submit the form on localhost, everything works as expected and siteverify returns success=true. When I submit the form on prod, the client-side works as expected. However, the siteverify immediately returns only ‘timeout-or-duplicate’ error-code. The time between when the widget finishes setting the ‘cf-turnstile-response’ and I get the ‘timeout-or-duplicate’ error is less than 5 seconds.
Here’s the siteverify response:
{
“success”: false,
“error-codes”: [
“timeout-or-duplicate”
],
“messages”:
}

I have 100% verified the following:

  • the token is fresh and unique
  • the token that is being sent to siteverify matches what is set in the client and appears to be valid.
  • the key and secret are correct for prod

In addition, I tried using the working ‘localhost’ site configuration, after adding my prod domain and updating the key/secret pair on prod. I get the exact same results, browser works, server submits the ‘cf-turnstile-response’, siteverify returns the same error-code.

I 100% verified the following:

  • the updated ‘localhost’ site configuration is correct (initially the browser rejected with a 110200 error , after a couple minutes it accepted the browser connection and started pulling a valid ‘cf-turnstile-response’. )
  • the request from the prod server is using the correct key/secret pair
  • the ‘cf-turnstile-response’ is unique, appears valid and is being sent to siteverify

Anybody run into a similar issue or have any ideas, I’m all out.

I’m experiencing the same issue with “timeout-or-duplicate” and I haven’t found a solution yet.

Yeah, I recently re-enabled the turnstile feature on my production site and re-confirmed its using the correct credentials. I’m still blocked by the issue. Whatever is wrong, it isn’t a short term issue. Fixing it is a low priority right now, since no bots are spamming my forms… yet. I’ll poke around at it again when it bubble up on the backlog again.