Do I need a proxy for the BMP variant?

No. The BMP sensor binds to `deviceId` + `packageName`, not IP address. We left `AntiAkamaiBMPTask` (with proxy params) in the API only for symmetry with the Web variant — the proxy fields are accepted but ignored on this path.

How do I find my app's BMP SDK version?

Either look at the app's dependency / build manifest (Android: search `akamai-bmp-android` in Gradle output; iOS: BMP cocoapod version), or `apktool d ` and grep for `akamai` in the resulting smali. Versions look like `3.4.6` or `3.5.0`. Pin to whatever the production app ships with.

How do I use the sensors[] array?

Each element is a single-use base64 string. Drop sensors[0] into the `X-acf-sensor-data` header on your next request to Akamai, then pop it off the array. When the array is empty, call /createTask again. Requesting `count: 5` upfront is the cheapest way to absorb a 5-request burst.

Why is the deviceId 16 chars of hex?

That's the format the BMP SDK derives from `Settings.Secure.ANDROID_ID` on Android or `UIDevice.identifierForVendor` on iOS. Akamai's server-side validator accepts any well-formed value as long as it stays stable for the duration of the 'session' and matches across the sensor + UA fingerprint.

Web vs BMP — which do I need?

Web (`AntiAkamaiWebTask`) is for scraping the customer's website through a browser. BMP (this product) is for replaying native mobile-app API calls. If your target is the same backend BUT you're hitting it from a desktop scraper, use Web. If you're emulating the mobile app and need the `X-acf-sensor-data` header, use BMP.

Will Akamai detect the same deviceId across two solves?

Only if you reuse it. Each solve generates a fresh random deviceId by default. Reuse the same one across consecutive sensor-generation calls when you want Akamai to score a session as a returning device; rotate it when you want a new identity.

What if the app's BMP version doesn't match anything you support?

We track currently-deployed Akamai BMP SDK versions and roll updates centrally. If your call returns `ERROR_UNSUPPORTED_VERSION`, that version isn't supported yet — file an issue with the exact version string and we'll either roll it out or tell you which compatible version to pin to.

Akamai Bot Manager (BMP) Mobile Sensor Generator

Before you submit — these must be correct

If any of these are wrong, your token may be accepted by our solver but rejected or scored poorly by the target site. We can’t detect these mismatches for you.

Use the userAgent we return. Akamai's mobile BMP path correlates the UA with the deviceId and the sensor signature. Override it with your own UA string and the sensor is rejected on the very first replay.
Send the EXACT packageName your app ships with (e.g. `com.target.app`, not just `app`). BMP's server-side validator scopes each sensor to the package; sending a mismatched name returns 4xx immediately.
BMP SDK versions matter. Akamai retires older versions on rotation — pin `version` to whatever your app's bundle ships with, and watch for `429 / 403` returning suddenly when the customer's app upgrades.
This is the mobile SDK variant. If you're scraping the website (browser-style), the X-acf-sensor-data header doesn't apply — use Akamai Web at /products/akamai-web instead.

What is Akamai Bot Manager — Mobile / BMP?

Akamai's Bot Manager Premier (BMP) ships as a native SDK that Android and iOS apps embed alongside Akamai-protected API calls. Each outbound request is signed with an `X-acf-sensor-data` header derived from a per-device sensor payload — the same algorithm family as the web `_abck` cookie, but emitted by the mobile SDK rather than a JS bundle. The sensor payload encodes device identity (`deviceId`), the host app's `packageName` and version, the BMP SDK version, and a stream of fake-but-plausible hardware signals (accelerometer, gyroscope, battery, locale, screen). Akamai validates the payload against its model and either lets the API call through or returns a 4xx with a re-challenge marker. Use this product whenever you're replaying a native mobile app's API call — not when you're scraping the website. For the web/desktop variant (bmak JS bundle, _abck cookie) see /products/akamai-web.

How It Works

Send Task

POST your AntiAkamaiBMPTaskProxyLess with the target URL and sitekey to our API. We'll queue it instantly.

We Solve

Capzy runs the real Akamai BMP runtime server-side and emits sensor payloads on demand. You send the app's `packageName` (e.g. `com.target.app`) and BMP SDK `version` (e.g. `3.4.6`); we return a `deviceId`, the matching `useragent` the BMP SDK would set on the request, and an array of one or more freshly-generated `sensors[]` blobs ready to drop into the `X-acf-sensor-data` header. Matching schema to the industry-standard CapSolver `AntiAkamaiBMPTask` — pointing your existing client at `https://api.capzy.ai` with `type: AntiAkamaiBMPTaskProxyLess` works without any other change. No proxy is required because BMP sensors are bound to `deviceId` + `packageName`, not IP. The Proxy variant exists only for API symmetry (so a single client can route both Web and BMP through identical task shapes).

Get Token

Poll getTaskResult — when status is 'ready', the solution contains the token to inject into the target page.

Quick Integration

solve.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiAkamaiBMPTaskProxyLess",
        "type": "AntiAkamaiBMPTaskProxyLess",
        "version": "3.4.6",
        "packageName": "com.target.app"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

task parameters.

fieldtyperequireddescription

typetypestringreqyesTask identifier in the `/createTask` JSON body. Send `AntiAkamaiBMPTaskProxyLess` — the `AntiAkamaiBMPTask` variant accepts proxy fields only for API symmetry with the Web product; the sensor itself never uses them.

packageNametypestringreqyesNative app's package identifier. Android: reverse-domain like `com.target.app`. iOS: the bundle identifier (e.g. `com.target.app`). Must match what the real app ships with — Akamai validates package against the sensor.

versiontypestringreqyesAkamai BMP SDK version embedded in the app, e.g. `3.4.6`. Find it in the APK by greping for `akamai-bmp` or in your app's dependency tree. Old versions get retired by Akamai; pin to whatever the live app uses.

platformtypestringreqno`android` or `ios`. Defaults to `android` if unset — they share the sensor format but use different UA / deviceId conventions.

counttypenumberreqnoNumber of sensor payloads to generate in one call. Defaults to 1. Use 2-3 if you need to replay multiple requests off the same task without re-solving each time (each sensor is single-use; once Akamai sees it, it's burned).

metadatatypeobjectreqnoOptional pass-through map for advanced customers — e.g. forcing a specific deviceId, locale, or screen size. Most callers leave it empty and let us generate plausible values.

solution response.

fieldtypedescription

deviceIdtypestring16-char hex device identifier the BMP SDK would normally derive from hardware. Reuse the same deviceId across subsequent sensor generations for the same logical 'session' to look like a returning user.

useragenttypestringExact User-Agent the BMP SDK sets on the request. Pin this onto your replay HTTP client — Akamai cross-checks UA against the sensor signature.

sensorstypearrayArray of base64-encoded sensor payload strings, one per requested `count`. Each one is single-use: take element [0], set it as the `X-acf-sensor-data` header value on your next request, then pop it off the list. When the array is empty, solve again.

versiontypestringEcho of the BMP SDK version the payload was generated against. Useful for logging / version-drift detection.

Example response

Full getTaskResult response shape. The fields in the table above describe what's inside solution — the outer envelope (errorId, status) is identical for every captcha type.

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "sensors": [
      "<base64 sensor payload — single-use>",
      "<base64 sensor payload — single-use>"
    ],
    "version": "3.4.6",
    "deviceId": "a1b2c3d4e5f60718",
    "useragent": "BMP/3.4.6 (Android; com.target.app/1.0.0; SDK 33)"
  }
}

Error response

Failures use the same envelope with errorId: 1 plus errorCode + errorDescription. See the error-code reference for the full list.

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up — automatically refunded."
}

Pending response

While the solver is still working, getTaskResult returns status: "processing". Poll every 1–2 seconds until ready or failed.

{
  "errorId": 0,
  "status": "processing"
}

Features

Pure API — no browser launch, no proxy needed (sensor is bound to deviceId + packageName, not IP)

Sub-second per sensor — typical solve completes in <1s

Batch generation via `count` — return 2-10 sensors in a single call to absorb burst load

Drop-in compatible with the industry-standard `AntiAkamaiBMPTask` schema; change one URL + one key to migrate

Server-side BMP runtime — when Akamai rotates sensor algorithms or retires old SDK versions, we update centrally

ProxyLess Task Type

AntiAkamaiBMPTaskProxyLess

With Proxy

AntiAkamaiBMPTask

Frequently Asked Questions

start solving akamai bot manager — mobile / bmp.

$0.10 in free credits — no card. ~250 free solves to test before you spend.

get free api key read docs

Akamai Bot Manager — Mobile / BMP, solved in 1.0s.