Cloudflare Turnstile action and cData demo

#!/usr/bin/env bash
# Solve this page's Cloudflare Turnstile widget with createTask, then check the token here.
set -euo pipefail
API=${ZEROCAPTCHA_API:-https://api.zerocaptcha.io}
KEY=${ZEROCAPTCHA_KEY:?Set ZEROCAPTCHA_KEY to your API key, zc_live_..., from the dashboard.}

# 1. createTask for this page and its sitekey.
#    metadata holds this widget's data-action and data-cdata: a site that checks them
#    refuses a token solved without them, so copy them from the widget you solve.
#    To solve through your own proxy, make the type TurnstileTask and add
#    proxy: "http://user:pass@proxy.example.net:8080" to the task.
#    CALLBACK_URL, when set, is called with the result when the task ends.
BODY=$(jq -n --arg key "$KEY" --arg callback "${CALLBACK_URL:-}" '{
  clientKey: $key,
  task: {
    type: "TurnstileTaskProxyless",
    websiteURL: "https://zerocaptcha.io/captcha-test/cloudflare-turnstile-action-cdata",
    websiteKey: "0x4AAAAAAFMVDQUY9ZAPO0ni",
    metadata: {action: "demo_login", cdata: "demo-session-42"}
  },
  callbackUrl: (if $callback == "" then null else $callback end)
}')
CREATED=$(curl -sS --fail-with-body "$API/createTask" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d "$BODY")
# errorId 1 is a refusal: errorCode and errorDescription say why.
if [ "$(jq -r .errorId <<<"$CREATED")" != 0 ]; then echo "$CREATED" >&2; exit 1; fi
TASK_ID=$(jq -r .taskId <<<"$CREATED")

# 2. getTaskResult every 2 seconds until the task is ready; errorId 1 means it failed, unpaid.
while :; do
  sleep 2
  RESULT=$(curl -sS --fail-with-body "$API/getTaskResult" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg key "$KEY" --arg id "$TASK_ID" '{clientKey: $key, taskId: $id}')")
  if [ "$(jq -r .errorId <<<"$RESULT")" != 0 ]; then echo "$RESULT" >&2; exit 1; fi
  if [ "$(jq -r .status <<<"$RESULT")" = ready ]; then break; fi
done
TOKEN=$(jq -r .solution.token <<<"$RESULT")

# 3. Use solution.token once, within 300 seconds: here, this page's check, which asks
#    Cloudflare's siteverify. Or paste it into the token box on the page.
curl -sS --fail-with-body "$API/v1/demo/verify" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg token "$TOKEN" '{widget: "managed", token: $token}')"