Skip to main content
Are you experiencing issues obtaining the token?
Contact support

Cloudflare Challenge

View full price

More on the topic in our blog
More on the topic in our blog
Important:

CapMonster Cloud can return the solution result as either a token or a cf_clearance cookie. Before getting started, review both options and choose the one that best fits your use case.

Request parameters​


IMPORTANT: some parameter values are dynamic — they change with each render of the page using Cloudflare Challenge.
Extract them immediately before creating the task to avoid errors during solving.
See examples of automatic parameter extraction in the section How to find all required parameters for task creation.

Option 1. Challenge (token)​

Attention!

  • CapMonster Cloud uses built-in proxies by default — their cost is already included in the service. You only need to specify your own proxies in cases where the website does not accept the token or access to the built-in services is restricted.

  • If you are using a proxy with IP authorization, make sure to whitelist the address 65.21.190.34.

  • After solving, you will receive a token to confirm captcha completion.

type<string>required

TurnstileTask

websiteURL<string>required

The URL of the page where the captcha is solved

websiteKey<string>required

Turnstile site key (see section How to find all required parameters for task creation)

cloudflareTaskType<string>required

token

pageAction<string>required

The action field found in the callback function. If using cloudflareTaskType, action is usually “managed” or “non-interactive”.

userAgent<string>required

Browser User-Agent.
Pass only a valid UA from Windows OS. Currently it is: userAgentPlaceholder

data<string>required

The value of the data field, taken from cData.

pageData<string>required

The value of pageData, taken from chlPageData.

apiJsUrl<string>optional

String containing the captcha script URL.

proxyType<string>optional

http - standard http/https proxy;
https - try this if "http" doesn't work (needed for some custom proxies);
socks4 - socks4 proxy;
socks5 - socks5 proxy.

proxyAddress<string>optional

IP address of the proxy (IPv4/IPv6). Not allowed:

  • using transparent proxies (those exposing the client IP);
  • using local machine proxies.

proxyPort<integer>optional

Proxy port.

proxyLogin<string>optional

Proxy login.

proxyPassword<string>optional

Proxy password.


These parameters are in the object passed to window.turnstile.render(el, paramsObj) when creating the captcha. You can retrieve them, for example, by executing JavaScript before loading other scripts:

(function () {
  const obj = {
    render: function () {
      const { action, cData, chlPageData } = arguments[1];
        const params = [
          ["action", action],
          ["data", cData],
          ["pageData", chlPageData],
        ];
        console.table(params)
    }
  };

  Object.defineProperty(window, "turnstile", {
    get: () => {
      return obj;
    },
  });
})();

When window.turnstile.render(el, paramsObj) is called, the captcha loads on the page, and upon successful solving, the callback function passes the solution information.

window.turnstile.render(el, paramsObj):

  • el: DOM element to insert the captcha.
  • paramsObj: Object containing captcha information and solving instructions. Usually includes sitekey, action, cData, chlPageData, callback.
  • callback: Function called after captcha is successfully solved.
Attention!

  • Use your own proxies for this task.

  • After solving, you will receive special cookies to add to your browser.

type<string>required

TurnstileTask

websiteURL<string>required

The URL of the page where the captcha is solved

websiteKey<string>required

Turnstile site key (any string is acceptable)

cloudflareTaskType<string>required

cf_clearance

htmlPageBase64<string>required

Base64-encoded HTML page of "Just a moment" shown with 403 response.
Example to get htmlPageBase64:

var serializer = new XMLSerializer();
var fullHtml = serializer.serializeToString(document);

var htmlBase64 = btoa(unescape(encodeURIComponent(fullHtml)));
console.log(htmlBase64);
userAgent<string>required

Browser User-Agent.
Provide only the current Windows UA: userAgentPlaceholder

proxyType<string>required

http - regular HTTP/HTTPS proxy;
https - use if http doesn’t work (required for some custom proxies);
socks4 - SOCKS4 proxy;
socks5 - SOCKS5 proxy.

proxyAddress<string>required

Proxy IP address (IPv4/IPv6). Not allowed:

  • Transparent proxies
  • Local machine proxies

proxyPort<integer>required

Proxy port.

proxyLogin<string>required

Proxy login.

proxyPassword<string>required

Proxy password.

Create task method​

Option 1. Challenge (token)​

POST
https://api.capmonster.cloud/createTask

Request

{
  "clientKey": "API_KEY",
  "task": {
    "type": "TurnstileTask",
    "websiteURL": "https://example.com",
    "websiteKey": "YOUR_WEBSITE_KEY_HERE",
    "cloudflareTaskType": "token",
    "userAgent": "userAgentPlaceholder",
    "pageAction": "managed",
    "pageData": "HUHDWUHuhuwfiweh32..uh2uhuhyugYUG=",
    "data": "874291f4retD1366"
  }
}

Response

{
  "errorId": 0,
  "taskId": 407533072
}
POST
https://api.capmonster.cloud/createTask

Request

{
  "clientKey": "API_KEY",
  "task": {
    "type": "TurnstileTask",
    "websiteURL": "https://example.com",
    "websiteKey": "xxxxxxxxxx",
    "cloudflareTaskType": "cf_clearance",
    "htmlPageBase64": "PCFET0NUWVBFIGh0...vYm9keT48L2h0bWw+",
    "userAgent": "userAgentPlaceholder",
    "proxyType": "http",
    "proxyAddress": "8.8.8.8",
    "proxyPort": 8080,
    "proxyLogin": "proxyLoginHere",
    "proxyPassword": "proxyPasswordHere"
  }
}

Response

{
  "errorId":0,
  "taskId":407533072
}

Get task result method​

Option 1. Challenge (token)​

POST
https://api.capmonster.cloud/getTaskResult

Request

{
  "clientKey": "API_KEY",
  "taskId": 407533072
}

Response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "userAgent": "userAgentPlaceholder",
    "token": "0.iGX3xsyFCkbGePM3jP4P4khLo6TrLukt8ZzBvwuQOvbC...f61f3082"
  }
}

Use the getTaskResult method to retrieve the Challenge solution. Depending on system load, the response can take between 5 and 20 seconds.

PropertyTypeDescription
tokenStringUse this token when calling the callback function
POST
https://api.capmonster.cloud/getTaskResult

Request

{
  "clientKey": "API_KEY",
  "taskId": 407533072
}

Response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cf_clearance": "1tarGvbY2_ZhQdYxpSBloao.FoOn9VtcJtmb_IQ_hCE-1761217338-1.2.1.1-vyVPoLYIGX0VCJomVuLjF7n0kdM0PXaPjpDsRcohxGr7hb2CE7WfcHpmQZ70goqEjdWxPsDhSVaKNTz9opxWguiNdWEEq_.SceWXIqfP7tnEb69f3bP0mixNqcWy_5P_9INpoAEqr1k7aYU0r45PT4gPr5pwHxedVySyLRdoBXIJasdTE52YOQ3NPdGWTwQ_3h2n_wYqqIvf0kCSAvimRrmsgZxomlyejwqPI6ZHi.w"
  }
}
PropertyTypeDescription
cf_clearanceStringSpecial Cloudflare cookies that you can set in your browser

How to differentiate Challenge from Turnstile​

Differences between Challenge and Turnstile

Cloudflare verification types can appear in different ways.

Standard Turnstile:

Stylized variants:

The challenge is seamlessly integrated into the website

Looks like a normal Turnstile captcha, but it is actually a Cloudflare challenge

To confirm Challenge presence, open developer tools, inspect network traffic, and check the page source for typical signs:

  • The first request to the site returns a 403 status code:

  • The form with id challenge-form has an action attribute (not to be confused with Turnstile captcha action) containing the parameter __cf_chl_f_tk=:

  • The page contains two similar <script> tags that create new values in the window object:

How to find all required parameters for task creation​

Automatically​

To automate parameter extraction, you can retrieve them via a browser (regular or headless, e.g., using Playwright) or directly from HTTP requests. Since dynamic parameter values are short-lived, it is recommended to use them immediately after retrieval.

Important!

The provided code snippets are basic examples for learning how to extract the required parameters. The exact implementation will depend on your captcha page, its structure, and the HTML elements and selectors used.

For Option 1: Challenge (token) – Node.js
import { chromium } from "playwright";

(async () => {
  const browser = await chromium.launch({ headless: false });
  const page = await browser.newPage();

  let params = null;

  try {
    while (!params) {
      await page.goto("https://example.com");

      await page.evaluate(() => {
        window.turnstile = new Proxy(window.turnstile, {
          get(target, prop) {
            if (prop === "render") {
              return function (a, b) {
                const p = {
                  websiteKey: b.sitekey,
                  websiteURL: window.location.href,
                  data: b.cData,
                  pagedata: b.chlPageData,
                  action: b.action,
                  userAgent: navigator.userAgent,
                };
                window.params = p;
                return target.render.apply(this, arguments);
              };
            }
            return target[prop];
          },
        });
      });

      params = await page.evaluate(() => {
        return new Promise((resolve) => {
          setTimeout(() => resolve(window.params || null), 5000);
        });
      });

      if (!params) {
        await page.waitForTimeout(3000);
      }
    }

    console.log("Turnstile Params:", params);
  } finally {
    await browser.close();
  }
})();
For Option 2: Challenge (cookie cf_clearance) – Node.js
import { chromium } from "playwright";
import { Buffer } from "buffer";

(async () => {
  const browser = await chromium.launch({ headless: false });
  const page = await browser.newPage();

  let websiteKey = null;

  while (!websiteKey) {
    await page.goto("https://example.com");

    await page.evaluate(() => {
      window.turnstile = new Proxy(window.turnstile, {
        get(target, prop) {
          if (prop === "render") {
            return function (a, b) {
              window.websiteKey = b.sitekey;
              return target.render.apply(this, arguments);
            };
          }
          return target[prop];
        },
      });
    });

    websiteKey = await page.evaluate(() => {
      return new Promise((resolve) => {
        setTimeout(() => resolve(window.websiteKey || null), 5000);
      });
    });

    if (!websiteKey) {
      await page.waitForTimeout(3000);
    }
  }

  const html = await page.content();
  const htmlPageBase64 = Buffer.from(html).toString("base64");

  const result = {
    websiteKey,
    htmlPageBase64,
  };

  console.log(result);

  await browser.close();
})();

Use the SDK Library​

Option 1. Challenge (token)
// https://github.com/ZennoLab/capmonstercloud-client-js

import { 
    CapMonsterCloudClientFactory, 
    ClientOptions, 
    TurnstileRequest 
} from '@zennolab_com/capmonstercloud-client';

const API_KEY = "YOUR_API_KEY"; // Specify your CapMonster Cloud API key

document.addEventListener("DOMContentLoaded", async () => {
    const client = CapMonsterCloudClientFactory.Create(
        new ClientOptions({ clientKey: API_KEY })
    );

    // Basic example without proxy
    // CapMonster Cloud automatically uses its own proxies
    let turnstileRequest = new TurnstileRequest({
        websiteURL: "https://example.com", // URL of the captcha page
        websiteKey: "YOUR_WEBSITE_KEY_HERE", // Replace with the correct value
        data: "YOUR_DATA_HERE",
        pageAction: "managed",
        cloudflareTaskType: "token",
        pageData: "YOUR_PAGE_DATA_HERE",
        userAgent: "userAgentPlaceholder"
    });

    // Example of using your own proxy
    // Uncomment this block if you want to use your own proxy

    /*
    const proxy = {
        proxyType: "http",
        proxyAddress: "123.45.67.89",
        proxyPort: 8080,
        proxyLogin: "username",
        proxyPassword: "password"
    };

    turnstileRequest = new TurnstileRequest({
        websiteURL: "https://example.com",
        websiteKey: "YOUR_WEBSITE_KEY_HERE",
        proxy,
        data: "YOUR_DATA_HERE",
        pageAction: "managed",
        cloudflareTaskType: "token",
        pageData: "YOUR_PAGE_DATA_HERE",
        userAgent: "userAgentPlaceholder"
    });
    */

    // Optionally, you can check the balance 
    const balance = await client.getBalance();
    console.log("Balance:", balance);

    const result = await client.Solve(turnstileRequest);
    console.log("Solution:", result);
});
Option 2. Challenge (cookie cf_clearance)
// https://github.com/ZennoLab/capmonstercloud-client-js

import { 
    CapMonsterCloudClientFactory, 
    ClientOptions, 
    TurnstileRequest 
} from '@zennolab_com/capmonstercloud-client';

document.addEventListener("DOMContentLoaded", async () => {
    const cmcClient = CapMonsterCloudClientFactory.Create(
        new ClientOptions({ clientKey: 'YOUR_API_KEY' }) // Specify your CapMonster Cloud API key
    );

    // Optionally, you can check the balance
    const balance = await cmcClient.getBalance();
    console.log('Balance:', balance);

    const proxy = {
        proxyType: "http",
        proxyAddress: '123.45.67.89',
        proxyPort: 8080,
        proxyLogin: 'username',
        proxyPassword: 'password'
    };

    // Cloudflare cf_clearance can only be solved with your own proxy
    const turnstileRequest = new TurnstileRequest({
        websiteURL: 'https://example.com/',
        websiteKey: 'xxxxx',
        cloudflareTaskType: 'cf_clearance',
        proxy,
        htmlPageBase64: 'PGh0bW...h0bWw+',
        userAgent: 'userAgentPlaceholder'
    });

    const result = await cmcClient.Solve(turnstileRequest);
    console.log('Solution:', result.solution);
});

Examples of solving Cloudflare Challenge (cf_clearance)​

The examples below demonstrate the general workflow for solving Cloudflare Challenge: obtaining the required parameters, creating a task in CapMonster Cloud, and using the cf_clearance cookie in subsequent requests. You can use the official SDK or work directly with the API — choose the integration method that best fits your needs.

Show code
import { ProxyAgent, setGlobalDispatcher } from "undici";

// ================= CONFIG (OR USE .ENV) =================

const API_KEY = "YOUR_API_KEY"; // Replace with your CapMonster Cloud API key

const URL = "https://www.example.com"; // Replace with the target URL
const SITEKEY = "xxxxxx";

const UA =
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";

// ================= PROXY (REPLACE WITH YOUR PROXY CREDENTIALS) =================

const PROXY_HOST = "PROXY_HOST";
const PROXY_PORT = 1234;
const PROXY_USER = "PROXY_USER";
const PROXY_PASS = "PROXY_PASS";

const proxy = new ProxyAgent(
  `http://${PROXY_USER}:${PROXY_PASS}@${PROXY_HOST}:${PROXY_PORT}`,
);

setGlobalDispatcher(proxy);

// ================= SESSION =================

let cookieHeader = "";

const headers = {
  "User-Agent": UA,
  Accept:
    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
  "Accept-Language": "en-US,en;q=0.9",
  "Accept-Encoding": "gzip, deflate, br",
  Connection: "keep-alive",
  "Upgrade-Insecure-Requests": "1",
  "Sec-Fetch-Dest": "document",
  "Sec-Fetch-Mode": "navigate",
  "Sec-Fetch-Site": "none",
  "Sec-Fetch-User": "?1",
  "sec-ch-ua":
    '"Chromium";v="149", "Google Chrome";v="149", "Not:A-Brand";v="99"',
  "sec-ch-ua-mobile": "?0",
  "sec-ch-ua-platform": '"Windows"',
};

// ================= FETCH PAGE =================

async function fetchPage(url) {
  const response = await fetch(url, {
    method: "GET",
    headers: {
      ...headers,
      ...(cookieHeader && {
        Cookie: cookieHeader,
      }),
    },
  });

  const buffer = Buffer.from(await response.arrayBuffer());

  return {
    status: response.status,
    body: buffer,
  };
}

// ================= SEND JSON POST REQUEST =================

async function postJson(url, data) {
  const response = await fetch(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
    },
    body: JSON.stringify(data),
  });

  return await response.json();
}

// ================= SOLVE CHALLENGE =================

async function solveTurnstile(htmlBase64) {
  const create = await postJson("https://api.capmonster.cloud/createTask", {
    clientKey: API_KEY,
    task: {
      type: "TurnstileTask",
      websiteURL: URL,
      websiteKey: SITEKEY,
      cloudflareTaskType: "cf_clearance",
      htmlPageBase64: htmlBase64,
      userAgent: UA,

      proxyType: "http",
      proxyAddress: PROXY_HOST,
      proxyPort: PROXY_PORT,
      proxyLogin: PROXY_USER,
      proxyPassword: PROXY_PASS,
    },
  });

  if (create.errorId) {
    throw new Error(JSON.stringify(create));
  }

  const taskId = create.taskId;

  console.log("Task ID:", taskId);

  while (true) {
    await new Promise((resolve) => setTimeout(resolve, 5000));

    const result = await postJson(
      "https://api.capmonster.cloud/getTaskResult",
      {
        clientKey: API_KEY,
        taskId,
      },
    );

    if (result.errorId) {
      throw new Error(JSON.stringify(result));
    }

    if (result.status === "ready") {
      return result.solution.cf_clearance;
    }

    console.log("Waiting...");
  }
}

// ================= MAIN FUNCTION =================

async function main() {
  // FIRST REQUEST

  const first = await fetchPage(URL);

  console.log("Initial status:", first.status);

  console.log(first.body.toString("utf8").substring(0, 800));

  // SOLVE CHALLENGE

  const htmlBase64 = first.body.toString("base64");

  const cfClearance = await solveTurnstile(htmlBase64);

  console.log("cf_clearance:", cfClearance);

  cookieHeader = `cf_clearance=${cfClearance}`;

  // SECOND REQUEST

  const second = await fetchPage(URL);

  console.log("Final status:", second.status);

  console.log(second.body.toString("utf8").substring(0, 800));
}

main().catch(console.error);
Show code (SDK)
import { ProxyAgent, setGlobalDispatcher } from "undici";
import {
  CapMonsterCloudClientFactory,
  ClientOptions,
  TurnstileRequest,
} from "@zennolab_com/capmonstercloud-client";

// ================= CONFIG (OR USE .ENV) =================

const API_KEY = "YOUR_API_KEY"; // Replace with your CapMonster Cloud API key

const URL = "https://www.example.com"; // Replace with your target URL
const SITEKEY = "xxxxxx";

const UA =
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";

// ================= PROXY (REPLACE WITH YOUR PROXY CREDENTIALS) =================

const PROXY_HOST = "PROXY_HOST";
const PROXY_PORT = 1234;
const PROXY_USER = "PROXY_USER";
const PROXY_PASS = "PROXY_PASSWORD";

const proxy = new ProxyAgent(
  `http://${PROXY_USER}:${PROXY_PASS}@${PROXY_HOST}:${PROXY_PORT}`,
);

setGlobalDispatcher(proxy);

// ================= INITIALIZE CAPMONSTER CLOUD SDK =================

const cmcClient = CapMonsterCloudClientFactory.Create(
  new ClientOptions({ clientKey: API_KEY }),
);

// ================= SESSION =================

let cookieHeader = "";

const headers = {
  "User-Agent": UA,
  Accept:
    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
  "Accept-Language": "en-US,en;q=0.9",
  "Accept-Encoding": "gzip, deflate, br",
  Connection: "keep-alive",
  "Upgrade-Insecure-Requests": "1",
  "Sec-Fetch-Dest": "document",
  "Sec-Fetch-Mode": "navigate",
  "Sec-Fetch-Site": "none",
  "Sec-Fetch-User": "?1",
  "sec-ch-ua":
    '"Chromium";v="149", "Google Chrome";v="149", "Not:A-Brand";v="99"',
  "sec-ch-ua-mobile": "?0",
  "sec-ch-ua-platform": '"Windows"',
};

// ================= FETCH PAGE =================

async function fetchPage(url) {
  const response = await fetch(url, {
    method: "GET",
    headers: {
      ...headers,
      ...(cookieHeader && {
        Cookie: cookieHeader,
      }),
    },
  });

  const buffer = Buffer.from(await response.arrayBuffer());

  return {
    status: response.status,
    body: buffer,
  };
}

// ================= SOLVE USING SDK =================

async function solveTurnstile(htmlBase64) {
  try {
    // Check account balance (optional)
    const balance = await cmcClient.getBalance();
    console.log("Balance:", balance);

    // Create solve request
    const turnstileRequest = new TurnstileRequest({
      websiteURL: URL,
      websiteKey: SITEKEY,
      cloudflareTaskType: "cf_clearance",
      htmlPageBase64: htmlBase64,
      userAgent: UA,
      proxy: {
        proxyType: "http",
        proxyAddress: PROXY_HOST,
        proxyPort: PROXY_PORT,
        proxyLogin: PROXY_USER,
        proxyPassword: PROXY_PASS,
      },
    });

    console.log("Submitting task...");
    const result = await cmcClient.Solve(turnstileRequest);

    console.log("Task solved!");
    return result.solution.cf_clearance;
  } catch (error) {
    throw new Error(`CapMonster Cloud SDK error: ${error.message}`);
  }
}

// ================= MAIN FUNCTION =================

async function main() {
  // FIRST REQUEST

  const first = await fetchPage(URL);

  console.log("Initial status:", first.status);

  console.log(first.body.toString("utf8").substring(0, 800));

  // SOLVE CHALLENGE

  const htmlBase64 = first.body.toString("base64");

  const cfClearance = await solveTurnstile(htmlBase64);

  console.log("cf_clearance:", cfClearance);

  cookieHeader = `cf_clearance=${cfClearance}`;

  // SECOND REQUEST

  const second = await fetchPage(URL);

  console.log("Final status:", second.status);

  console.log(second.body.toString("utf8").substring(0, 800));
}

main().catch(console.error);
Was this article helpful?
Check pricing for AI CAPTCHA solver