Skip to main content
Are you experiencing issues obtaining the token?
Contact support

Alibaba Cloud Captcha

View full price

Task examples​

Below are examples of Alibaba Captcha task types that are currently supported by the CapMonster Cloud service:

Slider CAPTCHA
Puzzle CAPTCHA
Image restoration CAPTCHA
Attention!

CapMonster Cloud uses built-in proxies by default — their cost is already included in the service. You only need to specify your own proxies in cases where the website does not accept the token or access to the built-in services is restricted.

If you are using a proxy with IP authorization, make sure to whitelist the address 65.21.190.34.

Request parameters​

type<string>required

CustomTask

class<string>required

alibaba

websiteURL<string>required

Full URL of the page with the CAPTCHA.

sceneId (inside metadata)<string>required

CAPTCHA scenario identifier, passed in the following format: "sceneId":"1ww7426c4" (see the corresponding section for how to find this value)

prefix (inside metadata)<string>required

CAPTCHA initialization parameter, passed in the URL of the request used to load the task text on the page.
For example, if the URL looks like: https://dlw3kug.captcha-open.example.aliyuncs.com/, then the value of the prefix parameter corresponds to the subdomain — dlw3kug.

Some websites require additional parameters:

Specify these parameters only if they are present on the website (see more details in the section Working with websites that include extended parameters).

userId (inside metadata)<string>optional

A unique identifier of the user or session on the website side.

userUserId (inside metadata)<string>optional

An additional (secondary) user identifier.

verifyType (inside metadata)<string>optional

The version or type of the captcha verification mechanism.

region (inside metadata)<string>optional

The server or data center region through which the captcha is processed.

UserCertifyId (inside metadata)<string>optional

A unique verification ID associated with the current captcha session.

apiGetLib (inside metadata)<string>optional

A link to the captcha JS library used by the website. The value is generated on the client side and may change dynamically on each page render.

userAgent<string>optional

Browser User-Agent.
Pass only a valid UA from Windows OS. Currently it is: userAgentPlaceholder

proxyType<string>optional

http - standard http/https proxy;
https - try this if "http" doesn't work (needed for some custom proxies);
socks4 - socks4 proxy;
socks5 - socks5 proxy.

proxyAddress<string>optional

IP address of the proxy (IPv4/IPv6). Not allowed:

  • using transparent proxies (those exposing the client IP);
  • using local machine proxies.

proxyPort<integer>optional

Proxy port.

proxyLogin<string>optional

Proxy login.

proxyPassword<string>optional

Proxy password.

Create task method​

Standard variant (without additional parameters)​

POST
https://api.capmonster.cloud/createTask

Request

{
  "clientKey": "API_KEY",
  "task": {
    "type": "CustomTask",
    "class": "alibaba",
    "websiteURL": "https://www.example.com",
    "userAgent": "userAgentPlaceholder",
    "metadata": {
      "sceneId": "1ww7426c4",
      "prefix": "dlw3kug"
    }
  }
}

Response

{
  "errorId": 0,
  "taskId": 407533077
}

Variant with extended parameters (userId, userUserId, verifyType, etc.):​

POST
https://api.capmonster.cloud/createTask

Request

{
  "clientKey": "API_KEY",
  "task": {
    "type": "CustomTask",
    "class": "alibaba",
    "websiteURL": "https://www.example.com",
    "userAgent": "userAgentPlaceholder",
    "metadata": {
      "sceneId": "1ww7426c4",
      "prefix": "dlw3kug",
      "userId": "HpadJlQnz2zSKcSmjXBaqQvjYUvP4jMJIk/ZwGNDNiM=",
      "userUserId": "/uSXKkVFuuwxXA21/MpXGxpLStWBEup1B3jjlMUWwNE=",
      "verifyType": "1.0",
      "region": "sgp",
      "UserCertifyId": "0a03e59417757735511105780e2a5e",
      "apiGetLib": "https://o.example.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js?t=2041"
    }
  }
}

Response

{
  "errorId": 0,
  "taskId": 407533077
}

Get task result method​

Use the getTaskResult method to obtain the Alibaba Captcha solution.

POST
https://api.capmonster.cloud/getTaskResult

Request

{
  "clientKey": "API_KEY",
  "taskId": 407533077
}

Response

{
  "errorId": 0,
  "errorCode": null,
  "errorDescription": null,
  "status": "ready",
  "solution": {
    "data": {
      "tokens": "{\"sceneId\":\"1ww7426c4\",\"certifyId\":\"kBjCxX2W2c\",\"deviceToken\":\"U0dfV0VCIzM3...wOGJkMjY=\",\"data\":\"JRMnX3B...EUQdCpLkqSj7THYNf3dn\"}"
    }
  }
}

How to find all required parameters for task creation​

sceneId​

sceneId can be obtained after successfully solving the CAPTCHA once:

  1. Solve the CAPTCHA manually on the website.
  2. Open DevTools → Network tab.
  3. Find the request sent after successful verification (e.g., verify, check, validate).
  4. In the Payload or Response, locate the sceneId (CaptchaSceneId or sId) parameter.

This parameter can also be found using search across network requests:

  1. Open the page with the CAPTCHA, then go to DevTools → Network tab.
  2. Use search (Ctrl + F) with the keyword sceneId or CaptchaSceneId.

prefix​

prefix can be obtained from the request URL used on the website to load the CAPTCHA task text:

  1. Open the page with the CAPTCHA.
  2. Find the request related to loading the task (usually via DevTools → Network).


Working with websites that include extended parameters​

Extracting and preparing captcha parameters​

This section describes the general process of extracting required parameters, solving the captcha, and re-submitting the authentication request on the target website.

  1. Initial authentication request:
POST https://example.com/api/v2/auths/signin

User credentials are sent:

{
  "email": "[email protected]",
  "password": "hashed_password"
}

Examples of headers are provided in the section Examples of automatic captcha solving.

  1. Server response detection. The server may return two types of responses:
  • 2.1 Standard JSON (no captcha required):
{
  "success": false,
  "data": {
    "code": "Bad_Request",
    "details": "The email or password provided is incorrect..."
  }
}

This means that no captcha is required and the request is processed normally.

  • 2.2 Captcha response (the server returns an HTML page instead of JSON):
<!doctype html>
<meta charset="UTF-8">
<meta name="aliyun_waf_aa" content="...">
<meta name="aliyun_waf_bb" content="...">
...
  1. Inside the page there is an object with the following data:
var requestInfo = {
  data,
  region,
  sceneId,
  token,
  traceid,
  type,
  userId,
  userUserId
}

From this object, extract the following parameters used for captcha solving:

  • userId
  • userUserId
  • verifyType (corresponds to type)
  • region
  • UserCertifyId (corresponds to traceid)

Important: additionally, you must store the authentication values token and traceid. They are used in subsequent authentication requests as u_atoken and u_asig respectively.


  1. Example of generating the captcha JS library URL:
this.currentDate = new Date()

this.AliyunGeneratedDynamicJS =
  `https://o.example.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js?t=${
    this.currentDate.getFullYear() +
    (this.currentDate.getMonth() + 1) +
    this.currentDate.getDate() +
    this.currentDate.getHours()
  }`
  1. Building metadata and the captcha solving request.

These data are sent to our captcha solving service:

{
  "metadata": {
    "sceneId": "1ww7426c4",
    "prefix": "dlw3kug",
    "userId": "HpadJlQnz2zSKcSmjXBaqQvjYUvP4jMJIk/ZwGNDNiM=",
    "userUserId": "/uSXKkVFuuwxXA21/MpXGxpLStWBEup1B3jjlMUWwNE=",
    "verifyType": "1.0",
    "region": "sgp",
    "UserCertifyId": "0a03e59417757735511105780e2a5e",
    "apiGetLib": "https://o.example.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js?t=2041"
  }
}
  1. Captcha solution retrieval and re-sending the authentication request using previously saved u_atoken and u_asig parameters:
POST https://example.com/api/v2/auths/signin?u_atoken=...&u_asig=...&u_aref=undefined

If the captcha is solved successfully, the server returns the authentication result (see step 2.1).

Examples of automatic captcha solving​

Important

The examples are for demonstration purposes only and illustrate the general logic of working with your website using Alibaba Cloud Captcha protection. In real-world projects, the code may require adaptation depending on the specific website, its requests, and headers.

Important data (API keys, proxy settings, etc.) should be stored in .env files or environment variables.

Show code (Node.js)
import "dotenv/config";
import fs from "fs";

import { gotScraping } from "got-scraping";

function parse(text, start, end, isJson = true) {
  const startIndex = text.indexOf(start);
  if (startIndex === -1) return null;

  const contentStart = startIndex + start.length;
  const endIndex = text.indexOf(end, contentStart);
  if (endIndex === -1) return null;

  let extracted = text.substring(contentStart, endIndex).trim();

  extracted = extracted.replace(/\n/g, "").trim();

  let jsonStr = extracted
    .replace(/(['"])?([a-zA-Z0-9_]+)(['"])?:/g, '"$2":')
    .replace(/'/g, '"');

  try {
    return isJson ? JSON.parse(jsonStr) : jsonStr;
  } catch (err) {
    console.error("Failed to parse JSON:", err.message);
    console.error("Parse attempt:", jsonStr);
    return null;
  }
}

function buildProxyLine(proxyUrl) {
  if (!proxyUrl) return undefined;

  const parts = proxyUrl.split(":");

  // Handling format protocol:ip:port (3 parts)
  if (parts.length === 3) {
    const [protocol, ip, port] = parts;
    return { proxyLine: `${protocol}://${ip}:${port}`, protocol, ip, port };
  }

  // Handling format protocol:username:password:ip:port (5 parts)
  if (parts.length === 5) {
    const [protocol, username, password, ip, port] = parts;
    return {
      proxyLine: `${protocol}://${username}:${password}@${ip}:${port}`,
      protocol,
      ip,
      port,
      username,
      password,
    };
  }

  // Invalid format
  return undefined;
}

const proxyUrl =
  process.env.proxyUrl || "http:username:password:127.0.0.1:9029"; // Replace with your proxy or set in .env file
const proxyLine = buildProxyLine(proxyUrl);
const delay = (ms) => new Promise((res) => setTimeout(res, ms));

class Worker {
  constructor() {
    this.providerVendorSolverUrl = "https://api.capmonster.cloud";
    this.API_KEY = process.env.apiKey || "YOUR_API_KEY"; // Replace with your CapMonster Cloud API key

    this.currentDate = new Date();
    // Dynamic captcha JS library URL generation
    this.AliyunGeneratedDynamicJS = `https://o.example.com/captcha-frontend/aliyunCaptcha/AliyunCaptcha.js?t=${
      this.currentDate.getFullYear() +
      (this.currentDate.getMonth() + 1) +
      this.currentDate.getDate() +
      this.currentDate.getHours()
    }`;

    this.websiteUrl = "https://example.com/auth"; // Replace with captcha page URL
    this.userAgent =
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36";
  }

  async executor() {
    console.log(`Fetching captcha parameters....`);
    const RequireAuthorizationResponses =
      await this.getAuthorizationResponses();
    console.log("Captcha pages successfully received");
    const requireParamsCaptchas = await this.requireParamsCaptchasData(
      RequireAuthorizationResponses,
    );
    console.log(`Captcha parameters: `, requireParamsCaptchas);
    const AlibabaSolvedResult = await this.requireAlibabaSolverResponse(
      requireParamsCaptchas,
    );
    console.log(
      `Captcha solving result: `,
      AlibabaSolvedResult?.solution?.data?.tokens,
    );
    const RequireAuthorizationResponsesAfterCaptchaBypass =
      await this.sendAuthrozationsRequest();
    console.log(RequireAuthorizationResponsesAfterCaptchaBypass);
  }

  async sendAuthrozationsRequest() {
    const response = await gotScraping.post(
      `https://example.com/api/v2/auths/signin?u_atoken=${this.AuthorizationParams.u_atoken}&u_asig=${this.AuthorizationParams.u_asig}&u_aref=undefined`,
      {
        body: JSON.stringify({
          email: "[email protected]",
          password:
            "e2577eeb61dc2197dfe94816d731f2941ccd0b66de8dc97aacb377bfe8476970",
        }),
        headers: {
          Accept: "application/json, text/plain, */*",
          "Accept-Encoding": "gzip, deflate, br, zstd",
          "Accept-Language": "en-US,en;q=0.9",
          "Content-Type": "application/json",
          Origin: "https://example.com",
          Pragma: "no-cache",
          Referer: "https://example.com/auth",
          Timezone: "Thu Apr 09 2026 23:29:23 GMT+0300",
          "User-Agent":
            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
          Version: "0.2.36",
          "X-Request-Id": "2b4a7a52-d273-4049-a826-156aae856fe5",
          "bx-v": "2.5.36",
          "sec-ch-ua":
            '"Chromium";v="146", "Not-A.Brand";v="24", "Google Chrome";v="146"',
          "sec-ch-ua-mobile": "?0",
          "sec-ch-ua-platform": '"Windows"',
          source: "web",
        },
      },
    );

    return response.body;
  }

  async getAuthorizationResponses() {
    const response = await gotScraping.post(
      `https://example.com/api/v2/auths/signin`, // Replace with actual auth URL that triggers captcha
      {
        body: JSON.stringify({
          email: "[email protected]",
          password:
            "e2577eeb61dc2197dfe94816d731f2941ccd0b66de8dc97aacb377bfe8476970",
        }),
        headers: {
          Accept: "application/json, text/plain, */*",
          "Accept-Encoding": "gzip, deflate, br, zstd",
          "Accept-Language": "en-US,en;q=0.9",
          "Content-Type": "application/json",
          Origin: "https://example.com",  // Replace with actual Origin
          Pragma: "no-cache",
          Referer: "https://example.com/auth", // Replace with actual Referer
          Timezone: "Thu Apr 09 2026 23:29:23 GMT+0300",
          "User-Agent":
            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
          Version: "0.2.36",
          "X-Request-Id": "2b4a7a52-d273-4049-a826-156aae856fe5",
          "bx-v": "2.5.36",
          "sec-ch-ua":
            '"Chromium";v="146", "Not-A.Brand";v="24", "Google Chrome";v="146"',
          "sec-ch-ua-mobile": "?0",
          "sec-ch-ua-platform": '"Windows"',
          source: "web",
        },
      },
    );

    if (response.body.includes("requestInfo")) {
      console.log("Captcha response received successfully:");
      fs.writeFileSync("./baseResponse.txt", response.body);
      console.log(response.body.substring(0, 150));
      return response.body;
    }

    console.log(response.body);
    return await this.getAuthorizationResponses();
  }

  async requireAlibabaSolverResponse(captchaMetadataParams) {
    let cmReqData = {
      type: "CustomTask",
      class: "alibaba",
      websiteURL: this.websiteUrl,
      websiteKey: "customTask",
      userAgent: this.userAgent,
    };

    if (captchaMetadataParams) {
      cmReqData.metadata = captchaMetadataParams;
    }

    const response = await gotScraping.post(
      `${this.providerVendorSolverUrl}/createTask`,
      {
        body: JSON.stringify({ clientKey: this.API_KEY, task: cmReqData }),
        headers: {
          "Content-Type": "application/json",
        },
      },
    );

    let JSON_responseData = JSON.parse(response.body);
    if (JSON_responseData.errorId) throw new Error("JSON.TaskId.error");

    let taskId = JSON_responseData.taskId;
    let responseData;

    while (true) {
      let cmTaskRes = { clientKey: this.API_KEY, taskId: taskId };

      let task_response = await gotScraping.post(
        `${this.providerVendorSolverUrl}/getTaskResult`,
        {
          body: JSON.stringify(cmTaskRes),
          headers: {
            "Content-Type": "application/json",
          },
        },
      );

      let JSON_responseDataTaskResponse = JSON.parse(task_response.body);

      if (JSON_responseDataTaskResponse.status !== "processing") {
        responseData = JSON_responseDataTaskResponse;
        break;
      }

      await delay(5000);
    }

    return responseData;
  }

  async requireParamsCaptchasData(responsesCaptchaPage) {
    const JsonData = parse(
      responsesCaptchaPage,
      ':none">var requestInfo = ',
      ";",
      true,
    );

    // Save authorization parameters for later use in retry login request
    this.AuthorizationParams = {
      u_atoken: JsonData.token,
      u_asig: JsonData.traceid,
    };

    return {
      prefix: "57d98d02303c01e7d2f7814c75224396",
      sceneId: JsonData.sceneId,
      userId: JsonData.userId,
      userUserId: JsonData.userUserId,
      verifyType: "1.0",
      region: JsonData.region,
      UserCertifyId: JsonData.traceid,
      apiGetLib: this.AliyunGeneratedDynamicJS,
    };
  }
}

new Worker().executor();
Was this article helpful?
Check pricing for AI CAPTCHA solver