Object
BotChallenge
Bot-challenge (CAPTCHA-style) configuration for the single platform-wide widget. Delivered to the public guest checkout / registration sheets (web app and embeds) so the client can render the challenge; the resulting token is verified server-side on the guest path (BuyerInput.botChallengeToken). Provider-neutral; the current provider is Cloudflare Turnstile. See issues #2455 / #2456.
Fields
siteKeyStringPublic bot-challenge site key. null when the platform hasn't configured a key (BOT_CHALLENGE_SITE_KEY unset) — the client then renders no challenge and server verification stays fail-open, so the widget can ship dark and be armed by provisioning the key. Safe to expose to the browser by design.