What is Akamai BMP (Mobile)?
Akamai Bot Manager Premier (BMP) is the native mobile SDK shipped inside many iOS and Android apps protected by Akamai. Every authenticated request from the app must carry an X-acf-sensor-data header containing a serialized, encrypted bundle of device telemetry — device model, OS version, accelerometer + gyroscope readings, touch event sequences, app state, and a Proof-of-Work computation. The Akamai edge validates that header before forwarding the request to the protected origin. This is fundamentally different from the desktop Web variant (which uses the _abck cookie via the bmak JS bundle). BMP is bound to the mobile app's native SDK, not to a browser. There's no JavaScript to execute — the SDK is compiled into the app binary and emits sensor_data via native code. We solve it server-side using a Go sidecar wrapping the open-source xvertile/akamai-bmp-generator. No browser, no proxy on our side — bytes in, sensor_data out.
How It Works
Send Task
POST your AntiAkamaiBMPTaskProxyLess with the target URL and sitekey to our API. We'll queue it instantly.
We Solve
1. Identify the Akamai BMP SDK version baked into the target app. Methods: • Inspect the APK / IPA — search for "bmak" or "akamai" in the binary, version strings are usually visible. • Observe a real device's traffic — the X-acf-sensor-data prefix often encodes the version. • Common versions in customer traffic: 3.3.4, 3.3.1, 4.2.1. 2. Submit a task with packageName (the app's bundle ID, e.g. "com.ihg.apps.android"), version (the BMP SDK version), and optional platform / count / metadata. 3. We return a sensors array (one element per requested count) plus the device-fingerprint-matched useragent and a deviceId. Both useragent and sensors[] MUST travel together on the same request — Akamai validates the UA against the device profile embedded in the sensor payload. 4. Set the response's sensors[i] as the X-acf-sensor-data header (and the useragent as User-Agent) on your HTTP requests. Akamai's edge accepts the request as legitimate mobile-app traffic. Sub-second solves in steady state. The sidecar holds device fingerprints + crypto state in RAM — no per-request setup cost. Our task type contract matches CapSolver's AntiAkamaiBMPTask shape exactly — if you already integrate with CapSolver for Akamai BMP, you can point at our API with zero code changes.
Get Token
Poll getTaskResult — when status is 'ready', the solution contains the token to inject into the target page.
Quick Integration
import requests, time
API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"
# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
"clientKey": KEY,
"task": {
"type": "AntiAkamaiBMPTaskProxyLess",
"type": "AntiAkamaiBMPTaskProxyLess",
"count": "1",
"powUrl": "https://m.ihg.com",
"version": "3.3.4",
"platform": "android",
"packageName": "com.ihg.apps.android"
}
}).json()
task_id = task["taskId"]
print(f"Task created: {task_id}")
# Step 2: Poll for result
while True:
result = requests.post(f"{API}/getTaskResult", json={
"clientKey": KEY,
"taskId": task_id
}).json()
if result["status"] == "ready":
print("Solved!", result["solution"])
break
elif result["status"] == "failed":
print("Failed:", result.get("errorDescription"))
break
time.sleep(1)
task parameters.
typetypestringreqyesAntiAkamaiBMPTaskProxyLess or AntiAkamaiBMPTask. Both route to the same sidecar — sensor generation doesn't use a proxy on our side.packageNametypestringreqyesThe protected mobile app's bundle ID, e.g. com.ihg.apps.android or com.starbucks.mobilecard. Akamai's BMP rule keys off the bundle ID.versiontypestringreqyesAkamai BMP SDK version baked into the app. Supported: 2.1.2, 2.2.2, 3.1.0, 3.2.3, 3.3.0, 3.3.1, 3.3.4, 4.2.1. (BMP 2.2.3 is currently broken upstream — re-listed when fixed.)platformtypestringreqnoandroid (default) or ios. iOS is NOT yet supported — the upstream generator ships only Android device fingerprints; iOS requests return ERROR_INVALID_TASK_DATA.counttypeintegerreqnoNumber of sensors to mint per task (1-50, default 1). Real mobile apps often need multiple sequential sensor posts per session; passing count=N saves you N round-trips through our API.metadatatypeobjectreqnoFor BMP v3.3.5+. Accepts { serversidesignal, appversion, language }. Currently passed through but not yet honoured by the upstream generator — accepting now for forward compatibility.powUrltypestringreqnoURL the protected app POSTs to. Scopes the Proof-of-Work challenge. Optional but recommended — passing the right URL increases the sensor's validity window.Features
ProxyLess Task Type
AntiAkamaiBMPTaskProxyLessWith Proxy
AntiAkamaiBMPTaskFrequently Asked Questions
start solving akamai bmp (mobile).
$0.10 in free credits — no card. ~250 free solves to test before you spend.