What exactly do I grab from the page?

When the challenge fires, your request gets a response with a `sec_cpt` cookie plus an embedded challenge. Grab two things: (1) the sec_cpt cookie value → secCpt. (2) the challenge config → secJson. If the response is an HTML 'Challenge Validation' page, the config is base64-encoded in the iframe's challenge="…" attribute (decode it). If it's a 428 JSON body, that body already IS the config.

How do I decode the challenge="…" attribute?

It's a base64 string. Decode it to bytes, then parse the bytes as JSON — you'll get {token, timestamp, nonce, difficulty, count, verify_url}, and that whole object is your secJson. (In Python: json.loads(base64.b64decode(challenge_attr)).)

How do I submit the token you return?

POST the returned `token` as the raw request body with Content-Type text/plain;charset=UTF-8 to `verify_url`, carrying your sec_cpt cookie, on the SAME session/IP. Once it's accepted, re-issue your original request on that session.

Why can't you fetch the 428 for me?

The sec-cpt interstitial is served against your session, IP, TLS fingerprint and prior _abck state. On a flagged IP Akamai returns a 403 hard block, never the 428 — so no external service can reach the challenge on your behalf. The proof-of-work itself is pure math, which is exactly the part we do.

The verify keeps failing even with a correct token — why?

The usual cause is Content-Type: use text/plain;charset=UTF-8, not application/json. Also make sure the sec_cpt cookie and IP on the verify POST match the ones that received the challenge.

Which cookies do I send in SUBMIT mode?

Send the Akamai cookie set your session was holding when the challenge fired: `_abck` (the Bot Manager clearance, marker ~0~), `bm_sz`, `ak_bmsc`, and `bm_sv`. You don't need to include `sec_cpt` in `cookies` — we add it from the `secCpt` param. App/session cookies (e.g. ASP.NET_SessionId) aren't needed for the verify but don't hurt. Pass them as `{name: value}` or `[{name, value}]`.

Before you submit — these must be correct

If any of these are wrong, your token may be accepted by our solver but rejected or scored poorly by the target site.

WHAT TO CAPTURE — from the response your own request got when the challenge fired (an HTTP 428, or a 200 HTML page titled 'Challenge Validation'), grab TWO things: (1) the `sec_cpt` cookie value from Set-Cookie → send as `secCpt`. (2) the challenge config → send as `secJson`.
GETTING secJson FROM AN HTML PAGE: the challenge is base64-encoded inside the iframe's challenge="…" attribute. Base64-decode that string to JSON — you get {token, timestamp, nonce, difficulty, count, verify_url}. That JSON is your secJson.
GETTING secJson FROM A 428 JSON BODY: some endpoints return the challenge as JSON directly. The body already has {token, timestamp, nonce, difficulty} — send it as secJson.
POST the token as text/plain;charset=UTF-8 (the returned content_type), NOT application/json, to the returned verify_url — carrying your sec_cpt cookie, from the SAME session/IP. Then re-issue your original request on that session.
WANT US TO SUBMIT IT? Pass your proxy (proxyAddress/proxyPort/…) plus your session cookies (cookies: {_abck, bm_sz, ak_bmsc, bm_sv}) and userAgent. We then mine AND POST the verify over httpcloak on YOUR proxy IP and return { submitted, verified, verifyStatus, cookies }. The proxy is required — clearance is bound to the IP that got the challenge.

Akamai sec-cpt

AkamaiSecCptToken

Akamai sec-cpt Solver, solved in 5.0s.

Solve Akamai's Adaptive Challenge (sec-cpt) proof-of-work. Capture the challenge from your own session — we mine the token for you to POST back (pure CPU, no proxy), OR pass your proxy + cookies and we submit the verify for you over httpcloak.

Get API Key Try Demo Examples

Avg Speed~5.0s

Success99%+

Cost / 1k$2.00

Throughput12/m

Akamai's Adaptive Challenge (sec-cpt) is a proof-of-work gate Akamai serves on a protected endpoint AFTER Bot Manager (_abck) has already passed. When it fires, your request gets either an HTTP 428 with a JSON body, or a 200 HTML page titled "Challenge Validation" — and a `sec_cpt` cookie. Embedded in that response is a challenge (a token, a nonce, and a difficulty). Your session has to mine a chained-SHA-256 answer, POST it to a verify URL, and then re-issue the original request. It's a separate layer from the _abck cookie (see /solvers/akamai-web).

Quick Integration

solve.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AkamaiSecCptToken",
        "secCpt": "3d9a8f...prefix~7c1e2b...~",
        "secJson": "{\"token\":\"eyJ0eXAiOiJKV1Qi...\",\"timestamp\":1735689600,\"nonce\":\"7f3a1c9e0b8d\",\"difficulty\":15000,\"count\":2,\"verify_url\":\"https://www.example.com/_sec/cp_challenge/verify\"}"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Using the result

Reaching the challenge is your job (session/IP-bound). Capture the sec_cpt cookie + the challenge — base64 in the page's challenge="…" attribute, or the 428 JSON body — and send them as secCpt + secJson. Then wait the enforced duration and POST the token as text/plain (NOT JSON) to verify_url on the same session.

use_result.py

import base64, json, re, time, requests
session = requests.Session()   # keep ONE session/IP for the whole flow

# Step 0 — capture the challenge from YOUR OWN request (session/IP-bound; we can't do this part)
r = session.get("https://target.example.com/protected")
sec_cpt = session.cookies.get("sec_cpt")                       # -> secCpt

if "Challenge Validation" in r.text:                            # HTML page form
    challenge_b64 = re.search(r'challenge="([^"]+)"', r.text).group(1)
    sec_json = json.loads(base64.b64decode(challenge_b64))      # {token, timestamp, nonce, difficulty, count, verify_url}
    sec_json["duration"] = int(re.search(r'data-duration=(\d+)', r.text).group(1))  # mandatory wait (s)
else:                                                           # 428 JSON body form
    sec_json = r.json()
    sec_json["duration"] = sec_json.get("chlg_duration", 0)

# Step 1-2 — createTask with {type, secCpt, secJson} + poll (see the code above), giving `result`.

# Step 3 — wait the enforced delay, POST the token (text/plain), then retry the SAME session
sol = result["solution"]
time.sleep(sol["duration"])                    # Akamai rejects an early POST
session.post(
    sol["verify_url"],                         # from the challenge config
    data=sol["token"],                         # the token payload IS the raw request body
    headers={"Content-Type": "text/plain;charset=UTF-8"},   # NOT application/json
)
resp = session.get("https://target.example.com/protected")     # interstitial cleared
print(resp.status_code)

1. Send Payload

Dispatch your AkamaiSecCptToken to our processing cluster via the secure API endpoint.

2. Solving Engine

Reaching the challenge is YOUR job — it's bound to your session, IP and TLS (a flagged IP gets a 403 hard block, never the 428, so a token service literally can't fetch it for you). You capture two things from that response — the `sec_cpt` cookie and the challenge config — and send them as `secCpt` + `secJson`. TOKEN mode (no proxy): we mine the proof-of-work locally (chained SHA-256, typically under 100 ms) and return the token to POST, the verify URL, and the exact Content-Type — you POST it. SUBMIT mode (proxy supplied): we go one step further and POST the verify ourselves over httpcloak (real Chrome-150 TLS) on YOUR proxy IP, returning whether Akamai accepted it plus the cleared cookies. We must use your proxy because sec-cpt clearance is bound to the IP that received the challenge.

3. Get Result

Poll getTaskResult for the validated token, then finalize your automated request.

Using your own proxy

Use AkamaiSecCptToken instead of AkamaiSecCptToken to route the solve through your own proxy — useful when the target site checks that the solving IP matches the submitting IP.

solve_proxy.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AkamaiSecCptToken",
        "secCpt": "3d9a8f...prefix~7c1e2b...~",
        "secJson": "{\"token\":\"eyJ0eXAiOiJKV1Qi...\",\"timestamp\":1735689600,\"nonce\":\"7f3a1c9e0b8d\",\"difficulty\":15000,\"count\":2,\"verify_url\":\"https://www.example.com/_sec/cp_challenge/verify\"}",
        "proxyAddress": "gw.yourproxy.com",
        "proxyPort": "8080",
        "proxyLogin": "your-proxy-user",
        "proxyPassword": "your-proxy-pass",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
        "cookies": "{\"_abck\":\"0EA5C7A1B2C3...~0~YAAQ0f1s...~-1~...\",\"bm_sz\":\"CEEB8EC04F6F422FB39E...~YAAQ0f1s...\",\"ak_bmsc\":\"015EEB2602240B9B180D...~000000000000000000...\",\"bm_sv\":\"655E36E7471D26A7D994...~YAAQ0f1s...\"}"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Additional proxy parameters

fieldtyperequireddescription

proxyAddresstypestringreqnoSUBMIT mode — supplying a proxy switches us from returning the token to POSTing the verify for you over httpcloak (real Chrome-150 TLS) on YOUR proxy IP, because sec-cpt clearance is bound to the IP that received the challenge. This is your proxy host.

proxyPorttypenumberreqnoYour proxy port (SUBMIT mode).

proxyLogintypestringreqnoProxy username, if authenticated (SUBMIT mode).

proxyPasswordtypestringreqnoProxy password, if authenticated (SUBMIT mode).

cookiestypeobjectreqnoSUBMIT mode — your session's Akamai cookie set so the clearance sticks. Pass _abck, bm_sz, ak_bmsc and bm_sv (sec_cpt is added automatically from secCpt). Accepts either {name: value} or [{name, value}].

userAgenttypestringreqnoSUBMIT mode — the User-Agent your session used; picks the matching Chrome-150 preset (windows/macos/linux). Defaults to Chrome-150 Windows.

verifyContentTypetypestringreqnoSUBMIT mode — override the verify Content-Type (default text/plain;charset=UTF-8).

Task Parameters

API Spec

fieldtyperequireddescription

typetypestringreqyesAkamaiSecCptToken

secCpttypestringreqyesThe `sec_cpt` cookie value Akamai set on the response that served the challenge. Looks like `SECPART~…~` or `AAA;BBB;CCC`. Send the WHOLE value — we hash the segment before the first ~ (or ;).

secJsontypeobjectreqyesThe challenge config. Required inside it: token, timestamp, nonce, difficulty. Optional: count (default 1) and verify_url. HTML page? base64-decode the iframe's challenge="…" attribute to get this JSON. JSON 428? the response body IS this object.

Response Shape

fieldtypedescription

tokentypestringThe ready-to-POST payload — a JSON string {token, answers}. Send it verbatim as the raw request body to verify_url with the returned content_type (don't re-encode it)

answerstypearrayThe mined proof-of-work answers (also embedded inside token)

verify_urltypestringWhere to POST the token — the sec-cpt verify endpoint from the challenge config (empty if your challenge didn't include one; use the verify URL from the page)

content_typetypestringThe Content-Type to POST the token with: text/plain;charset=UTF-8 (NOT application/json)

submittedtypebooleanSUBMIT mode only — true when we POSTed the verify for you (present only if you supplied a proxy)

verifiedtypebooleanSUBMIT mode only — true if Akamai accepted the verify (HTTP 200/201/204)

verifyStatustypenumberSUBMIT mode only — the HTTP status Akamai returned on the verify POST

cookiestypeobjectSUBMIT mode only — the cookie jar after verify (including the cleared _abck). Replay these on your re-issued request

rawtypeobjectThe same fields mirrored, for drop-in compatibility

Example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "token": "{\"token\":\"eyJ0eXAiOiJKV1Qi...\",\"answers\":[\"0.a1b2c3d4e5f60718\",\"0.9f8e7d6c5b4a3928\"]}",
    "answers": [
      "0.a1b2c3d4e5f60718",
      "0.9f8e7d6c5b4a3928"
    ],
    "verify_url": "https://www.example.com/_sec/cp_challenge/verify",
    "content_type": "text/plain;charset=UTF-8"
  }
}

Error response

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Pure CPU proof-of-work — typically under 100 ms, no browser, no proxy

You keep your own session, IP, and sec_cpt cookie — we only mine the answer

Returns verify_url + exact Content-Type so replay just works

Handles the difficulty ramp (each answer raises difficulty by 1) and multi-answer challenges

Optional SUBMIT mode: hand us your proxy + cookies and we POST the verify for you over httpcloak (Chrome-150) on your IP — returns the cleared cookies

Pricing & Stats

Per 1,000 solves$2.00

Avg solve time~5.0s

Success rate99%+