What's the difference between the two task types?

`AntiAkamaiWebTaskProxyLess` is the simple variant: pass a URL, get cookies back. Capzy picks the upstream IP, so the cookies are IP-bound to OUR egress — use this only if the same Capzy session will replay the request on your behalf. `AntiAkamaiWebTask` lets you supply your own `proxyAddress`/`proxyPort` so the cookies are bound to YOUR IP and you can replay them yourself with full TLS control.

Which cookies do I actually need to set?

All of them. Set every cookie object in the `cookies` array on your HTTP client before the next request — Akamai validates the full set together, and missing any one of them (especially `bm_sz`, which carries the PRNG seed for subsequent sensor posts) trips re-challenge.

How long do the cookies last?

The validated `_abck` typically lasts the browser session or a few hours. It's invalidated by (a) a protected action like login/checkout, (b) too long an idle gap, (c) any IP change, or (d) a UA/TLS mismatch on replay. Re-solve when you see Akamai's re-challenge response on a previously working request.

Will the cookies work with requests/httpx/fetch?

Not reliably. Akamai inspects TLS fingerprints (JA3 / JA4) and the HTTP/2 frame ordering on every request. Default Python urllib/requests has a recognisable non-browser fingerprint and is rejected at the network layer before the cookies are even checked. Use `curl_cffi` with Chrome impersonation, `tls-client`, or a real browser context for replay.

Banking / classifieds / big-retail sites still failing?

The hardest Akamai deployments combine standard Bot Manager with per-customer ML scoring and aggressive IP-reputation rules — the cleanest cookies in the world fail if the replay IP is on a known scraper list. Use `AntiAkamaiWebTask` with the cleanest proxy you have available and reuse the same IP across solve + replay.

I'm hitting a native mobile app endpoint. Is this the right product?

Probably not. If your request needs an `X-acf-sensor-data` header (or you're replaying an Android/iOS app's API), use Akamai BMP at /products/akamai-bmp instead. That solver returns mobile SDK sensor payloads directly over a fast API, and runs sub-second per call.

Before you submit — these must be correct

If any of these are wrong, your token may be accepted by our solver but rejected or scored poorly by the target site.

You do NOT need to send a User-Agent. We mint the _abck in a real Chrome browser and RETURN the exact User-Agent it used — pin THAT value on every subsequent request (Akamai binds the cookie to the UA + TLS fingerprint). If you must replay with a specific Chrome-family UA, pass it as `userAgent` and we'll mint with it; otherwise omit it and use the one we return.
Any Akamai-protected site works — sites do NOT need to be pre-registered with us. Just submit the task with the target `websiteURL`; there's no allow-list to be added to.
Cookies are IP-bound. Akamai cross-checks every request against the IP that earned the cookie — use the same proxy for the solve AND for the subsequent calls, or the cookies are rejected immediately. With `AntiAkamaiWebTaskProxyLess` you don't see the issuing IP, so use the ProxyLess variant only when you'll replay the request through Capzy on your behalf; otherwise use `AntiAkamaiWebTask` with your own proxy.
Use the userAgent we return. Akamai correlates UA with the TLS fingerprint that produced the cookie. Pin the value from the response into your HTTP client — UA mismatch invalidates the session.
Use a Chrome-compatible TLS stack on replay. Default Python urllib/requests TLS fails Akamai's Phase-1 check before the cookies are even evaluated. curl_cffi, tls-client, or a real browser work.
Hitting a native mobile app endpoint that expects `X-acf-sensor-data`? That's the BMP variant — use /products/akamai-bmp instead. This Web solver doesn't generate mobile SDK sensor payloads.

Akamai Bot Manager — Web/Desktop

AntiAkamaiWebTask

proxy required

Akamai Bot Manager — Web/Desktop, solved in 5.0s.

Bypass Akamai Bot Manager on web/desktop sites. Returns validated _abck (with ~0~), bm_sz, ak_bmsc cookies plus the matching User-Agent.

Get API Key Try Demo Examples

Avg Speed~5.0s

Success99%+

Cost / 1k$2.00

Throughput12/m

Akamai Bot Manager is one of the most widely deployed enterprise bot defense systems. On web/desktop deployments it collects 100+ browser signals via an obfuscated JS bundle (bmak), POSTs them as sensor_data, and validates the session via the _abck cookie. A validated _abck contains a `~0~` marker in its segments — e.g. `<hash>~0~<timestamp>~...`. Anything else means Akamai has either rejected the session (`~-1~`) or wants you to solve a secondary challenge (`~3~`). Akamai cross-references the cookie verdict with IP reputation (ASN check), TLS/JA3-JA4 fingerprint, and behavioral signals — all three must agree before a request to a protected endpoint succeeds. For native mobile apps (Android/iOS) that hit Akamai-protected APIs through the BMP SDK, use our separate /products/akamai-bmp solver instead — it returns sensor payloads + X-acf-sensor-data headers over a fast API.

Quick Integration

solve.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiAkamaiWebTask",
        "websiteURL": "https://example.com/",
        "proxyType": "http",
        "proxyAddress": "123.45.67.89",
        "proxyPort": "8080",
        "proxyLogin": "user",
        "proxyPassword": "pass"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Using the result

use_result.py

# Step 3: Use the result — set every cookie on a session jar
sol = result["solution"]
session = requests.Session()
for c in sol["cookies"]:
    session.cookies.set(c["name"], c["value"], domain=c.get("domain"), path=c.get("path", "/"))
session.headers["User-Agent"] = sol.get("userAgent", "")
# IMPORTANT: route through the SAME proxy you supplied at solve time
resp = session.get("https://target.example.com/", proxies={
    "http":  "http://USER:PASS@PROXY_HOST:PORT",
    "https": "http://USER:PASS@PROXY_HOST:PORT",
})
print(resp.status_code, len(resp.text), "bytes")

1. Send Payload

Dispatch your AntiAkamaiWebTask to our processing cluster via the secure API endpoint.

2. Solving Engine

Capzy's proprietary solver returns the validated Akamai cookies once the session is marked `~0~`. The solver returns the full cookie set (`_abck`, `bm_sz`, `ak_bmsc`, plus any secondary Akamai cookies the deployment issues), the exact User-Agent the browser used, and the host the cookies were validated against. Use `AntiAkamaiWebTaskProxyLess` to have Capzy handle the upstream IP, or `AntiAkamaiWebTask` with `proxyAddress`/`proxyPort` to pin the solve to a specific IP you'll reuse — Akamai cookies are IP-bound, so the IP that solves the challenge must be the IP that subsequently uses the cookies.

3. Get Result

Poll getTaskResult for the validated token, then finalize your automated request.

Task Parameters

API Spec

Proxy fields below are required for this captcha — userAgent must match the one you’ll use when submitting the resulting token.

fieldtyperequireddescription

typetypestringreqyesWhich variant you want. Use `AntiAkamaiWebTask` and pass your own `proxyAddress`/`proxyPort` — the cookies we return will be bound to YOUR proxy's IP so you can replay them yourself. Use `AntiAkamaiWebTaskProxyLess` only if Capzy will be making the next request on your behalf (we pick the IP, cookies are bound to OUR egress — you can't replay them from a different IP).

websiteURLtypestringreqyesFull URL of the Akamai-protected page. Use a real protected URL on the target host — landing pages without bmak don't issue a validated _abck.

userAgenttypestringreqnoOptional — you CAN pass your own User-Agent if you want us to mint with a specific Chrome-family value (send exactly what you'll replay with). If you omit it, we mint with a real Chrome and RETURN the exact User-Agent used. Either way the _abck is bound to the UA, so always replay with the userAgent from the solution (whether the one you sent or the one we chose).

initCookiestypeobjectreqnoOptional. Any Akamai bootstrap cookies you already hold for the target (e.g. an `ak_bmsc`/`bm_sz` from a prior page load), as a `{name: value}` object. Improves first-try success on sites that seed cookies before the sensor runs. Omit if you have none.

proxyTypetypestringreqyesProxy protocol: http, https, socks4, or socks5

proxyAddresstypestringreqyesProxy IP address or hostname

proxyPorttypenumberreqyesProxy port number

proxyLogintypestringreqnoProxy username (if auth required)

proxyPasswordtypestringreqnoProxy password (if auth required)

userAgenttypestringreqnoUser-Agent string to use. Must match the UA you use when submitting the token

Response Shape

fieldtypedescription

cookiestypearrayCookie objects in the form `{name, value, domain, path}`. Always includes `_abck` (containing ~0~), `bm_sz`, and any other Akamai cookies the deployment set (`ak_bmsc`, `bm_sv`, `bm_mi`, `bm_so`, `sbsd_o`). Set every cookie on your HTTP client before the next request.

userAgenttypestringExact User-Agent the browser used while earning the cookies. MUST be reused verbatim on subsequent requests — Akamai correlates UA with the TLS fingerprint that produced the cookie.

ipBoundtypebooleanAlways `true` for this task type. Cookies are bound to the IP that solved the challenge — reuse the same proxy for both solve and replay.

domaintypestringThe hostname the cookies were validated against (host of `websiteURL`). Cookies are scoped to this domain — set them on a different host and Akamai ignores them.

sensorPoststypenumberNumber of bmak sensor_data POSTs the solver fired during the validated session. Diagnostic — under normal conditions this is 1–3. Above that suggests the deployment is borderline and the cookies may have a shorter useful life.

Example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": [
      {
        "name": "_abck",
        "value": "<hash>~0~<timestamp>~...",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "bm_sz",
        "value": "<sensor PRNG seed cookie>",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "ak_bmsc",
        "value": "<value>",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "bm_sv",
        "value": "<value>",
        "domain": ".target.example.com",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
    "ipBound": true,
    "domain": "target.example.com",
    "sensorPosts": 2
  }
}

Error response

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Returns the validated `_abck` cookie (with `~0~`) plus the full secondary cookie set (`bm_sz`, `ak_bmsc`, `bm_sv`, `bm_mi` where issued)

User-Agent + cookies returned as a matched pair for direct session reuse

Produces the validated sensor_data payload bmak expects

Pixel-challenge (`~3~`) and rejected-session (`~-1~`) detection — fast-fail with a refund instead of grinding the timeout

Pricing & Stats

Per 1,000 solves$2.00

Avg solve time~5.0s

Success rate99%+