# agent turnstile secret rotated but the widget sitekey was not: logins failed

## TL;DR

The Turnstile secret rotated, but the widget still uses the old sitekey pairing, so verification fails. Secret and sitekey are a pair: rotate them together and update both the server and the widget. Half a rotation is a full outage.

```text
agent turnstile secret rotated but the widget sitekey was not (logins failed)
```

## Steps

1. Confirm the mismatch: the server's secret does not pair with the widget's sitekey.
   Expected: The half-rotation is proven.

2. Update the widget to the new sitekey (or rotate back and do both together).
   Expected: The pair matches.

3. Verify logins work end to end.
   Expected: The outage clears.

4. Make rotation update both halves atomically in the runbook.
   Expected: The pair stays paired.

5. Test the login flow after every future rotation.
   Expected: The check is routine.

## When to use

- Turnstile fails after a secret rotation
- logins break site-wide
- the widget config is separate from the server

## When not to use

- both were rotated (check for a different cause)
- the failure predates the rotation (different problem)
- using a different captcha (same pairing principle applies)

## Tool compatibility

- workerd
- Turnstile

## Variant phrasings

- "turnstile secret rotated sitekey not"
- "turnstile login failed rotation"
- "turnstile sitekey mismatch"

## Why it happens

Turnstile's secret and sitekey are a cryptographic pair; the server verifies challenges against the secret matching the widget's sitekey. Rotating one without the other breaks the pairing, and every login fails closed. The two values are one unit and must rotate as one.

## Edge cases

- the widget change may need a frontend deploy; plan the sequencing
- the verification is the test; unit tests do not catch pairing
- keep the old pair briefly during rotation for in-flight challenges

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_viJCVmaeqzS8-MdfYT4HSQ