Skip to content
capzy
Login

Akamai Bot Manager · Web

Build a cookie session for your desktop requests. Choose the Akamai-protected page and preserve bootstrap cookies when your session has them. Clearance is returned as cookies and browser identity.

Get the integration code
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiAkamaiWebTask",
    "websiteURL": "https://example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Protected URL + browser proxyYour session proxy requiredAkamai cookies + user-agent

Prepare the browser session.

Choose the Akamai-protected page and preserve bootstrap cookies when your session has them. Clearance is returned as cookies and browser identity.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Use the page that runs Bot Manager.

  1. In Network, navigate to the actual login, product, or account page and identify the document request and Akamai telemetry it loads.
  2. Copy the complete document URL into websiteURL. A sensor collector URL is a different input for the Sensor Data solver.
  3. Use a proxy exit your application can reuse after the task.
Input collection example - replace illustrative values
{
  "websiteURL": "https://example.com/login"
}

This browser flow returns a cleared cookie session. The Web Unlocker performs a configured action and returns HTML.

How Akamai Bot Manager · Web works

Akamai Bot Manager is one of the most widely deployed enterprise bot defense systems. On web/desktop deployments it collects 100+ browser signals via an obfuscated JS bundle (bmak), POSTs them as sensor_data, and validates the session via the _abck cookie. A validated _abck contains a `~0~` marker in its segments — e.g. `<hash>~0~<timestamp>~...`. Anything else means Akamai has either rejected the session (`~-1~`) or wants you to solve a secondary challenge (`~3~`). Akamai cross-references the cookie verdict with IP reputation (ASN check), TLS/JA3-JA4 fingerprint, and behavioral signals — all three must agree before a request to a protected endpoint succeeds. For native mobile apps (Android/iOS) that hit Akamai-protected APIs through the BMP SDK, use our separate /solvers/akamai-bmp solver instead — it returns sensor payloads + X-acf-sensor-data headers over a fast API.

Capzy's proprietary solver returns the validated Akamai cookies once the session is marked `~0~`. The solver returns the full cookie set (`_abck`, `bm_sz`, `ak_bmsc`, plus any secondary Akamai cookies the deployment issues), the exact User-Agent the browser used, and the host the cookies were validated against. Use `AntiAkamaiWebTaskProxyLess` to have Capzy handle the upstream IP, or `AntiAkamaiWebTask` with `proxyAddress`/`proxyPort` to pin the solve to a specific IP you'll reuse — Akamai cookies are IP-bound, so the IP that solves the challenge must be the IP that subsequently uses the cookies.

  • Returns the validated `_abck` cookie (with `~0~`) plus the full secondary cookie set (`bm_sz`, `ak_bmsc`, `bm_sv`, `bm_mi` where issued)
  • User-Agent + cookies returned as a matched pair for direct session reuse
  • Produces the validated sensor_data payload bmak expects
  • Pixel-challenge (`~3~`) and rejected-session (`~-1~`) detection — fast-fail with a refund instead of grinding the timeout

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Keep your proxy exit and session identity consistent when using this result.

Request authentication

Required task inputs

Optional context

Proxy connection

websiteURL

stringRequired

Full URL of the Akamai-protected page. Use a real protected URL on the target host — landing pages without bmak don't issue a validated _abck.

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide
Example valuehttps://example.com/
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiAkamaiWebTask",
    "websiteURL": "https://example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Load all returned cookies with their domain/path and use solution.userAgent through the same proxy. Inspect ipBound and domain before replaying the original request.

AntiAkamaiWebTask · $2.50 / 1,000
solve_akamai_web.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AntiAkamaiWebTask\",\"websiteURL\":\"https://example.com/\",\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

Akamai cookies + user-agent

Load all returned cookies with their domain/path and use solution.userAgent through the same proxy. Inspect ipBound and domain before replaying the original request.

array
Cookie objects in the form `{name, value, domain, path}`. Always includes `_abck` (containing ~0~), `bm_sz`, and any other Akamai cookies the deployment set (`ak_bmsc`, `bm_sv`, `bm_mi`, `bm_so`, `sbsd_o`). Set every cookie on your HTTP client before the next request.
string
Exact User-Agent the browser used while earning the cookies. MUST be reused verbatim on subsequent requests — Akamai correlates UA with the TLS fingerprint that produced the cookie.
boolean
Always `true` for this task type. Cookies are bound to the IP that solved the challenge — reuse the same proxy for both solve and replay.
string
The hostname the cookies were validated against (host of `websiteURL`). Cookies are scoped to this domain — set them on a different host and Akamai ignores them.
number
Number of bmak sensor_data POSTs the solver fired during the validated session. Diagnostic — under normal conditions this is 1–3. Above that suggests the deployment is borderline and the cookies may have a shorter useful life.
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": [
      {
        "name": "_abck",
        "value": "<hash>~0~<timestamp>~...",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "bm_sz",
        "value": "<sensor PRNG seed cookie>",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "ak_bmsc",
        "value": "<value>",
        "domain": ".target.example.com",
        "path": "/"
      },
      {
        "name": "bm_sv",
        "value": "<value>",
        "domain": ".target.example.com",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
    "ipBound": true,
    "domain": "target.example.com",
    "sensorPosts": 2
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Use the result

Load all returned cookies with their domain/path and use solution.userAgent through the same proxy. Inspect ipBound and domain before replaying the original request.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python

sol = result["solution"]
for c in sol["cookies"]:
    session.cookies.set(c["name"], c["value"], domain=c.get("domain"), path=c.get("path", "/"))
session.headers["User-Agent"] = sol["userAgent"]
# Reuse the original session and its configured solve proxy.
resp = session.get("https://target.example.com/", timeout=30)
print(resp.status_code)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

What's the difference between the two task types?

`AntiAkamaiWebTaskProxyLess` is the simple variant: pass a URL, get cookies back. Capzy picks the upstream IP, so the cookies are IP-bound to OUR egress — use this only if the same Capzy session will replay the request on your behalf. `AntiAkamaiWebTask` lets you supply your own `proxyAddress`/`proxyPort` so the cookies are bound to YOUR IP and you can replay them yourself with full TLS control.

Which cookies do I actually need to set?

All of them. Set every cookie object in the `cookies` array on your HTTP client before the next request — Akamai validates the full set together, and missing any one of them (especially `bm_sz`, which carries the PRNG seed for subsequent sensor posts) trips re-challenge.

How long do the cookies last?

The validated `_abck` typically lasts the browser session or a few hours. It's invalidated by (a) a protected action like login/checkout, (b) too long an idle gap, (c) any IP change, or (d) a UA/TLS mismatch on replay. Re-solve when you see Akamai's re-challenge response on a previously working request.

Will the cookies work with requests/httpx/fetch?

Not reliably. Akamai inspects TLS fingerprints (JA3 / JA4) and the HTTP/2 frame ordering on every request. Default Python urllib/requests has a recognisable non-browser fingerprint and is rejected at the network layer before the cookies are even checked. Use `curl_cffi` with Chrome impersonation, `tls-client`, or a real browser context for replay.

Banking / classifieds / big-retail sites still failing?

The hardest Akamai deployments combine standard Bot Manager with per-customer ML scoring and aggressive IP-reputation rules — the cleanest cookies in the world fail if the replay IP is on a known scraper list. Use `AntiAkamaiWebTask` with the cleanest proxy you have available and reuse the same IP across solve + replay.

I'm hitting a native mobile app endpoint. Is this the right product?

Probably not. If your request needs an `X-acf-sensor-data` header (or you're replaying an Android/iOS app's API), use Akamai BMP at /solvers/akamai-bmp instead. That solver returns mobile SDK sensor payloads directly over a fast API, and runs sub-second per call.

Integration checks for Akamai Bot Manager · Web
  • You do NOT need to send a User-Agent. We mint the _abck in a real Chrome browser and RETURN the exact User-Agent it used — pin THAT value on every subsequent request (Akamai binds the cookie to the UA + TLS fingerprint). If you must replay with a specific Chrome-family UA, pass it as `userAgent` and we'll mint with it; otherwise omit it and use the one we return.
  • Any Akamai-protected site works — sites do NOT need to be pre-registered with us. Just submit the task with the target `websiteURL`; there's no allow-list to be added to.
  • Cookies are IP-bound. Akamai cross-checks every request against the IP that earned the cookie — use the same proxy for the solve AND for the subsequent calls, or the cookies are rejected immediately. With `AntiAkamaiWebTaskProxyLess` you don't see the issuing IP, so use the ProxyLess variant only when you'll replay the request through Capzy on your behalf; otherwise use `AntiAkamaiWebTask` with your own proxy.
  • Use the userAgent we return. Akamai correlates UA with the TLS fingerprint that produced the cookie. Pin the value from the response into your HTTP client — UA mismatch invalidates the session.
  • Use a Chrome-compatible TLS stack on replay. Default Python urllib/requests TLS fails Akamai's Phase-1 check before the cookies are even evaluated. curl_cffi, tls-client, or a real browser work.
  • Hitting a native mobile app endpoint that expects `X-acf-sensor-data`? That's the BMP variant — use /solvers/akamai-bmp instead. This Web solver doesn't generate mobile SDK sensor payloads.

Connect Akamai Bot Manager · Web to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$2.50Per 1,000 solves
5.7sAverage solve time

AntiAkamaiWebTask · Live configuration