AWS WAF Captcha

AntiAwsWafTaskProxyLess

AWS WAF is Amazon's Web Application Firewall bot protection. It ships two distinct protections: • Challenge — a silent proof-of-work the browser runs invisibly. This is what most AWS WAF sites use. No visible puzzle; the page just needs a valid aws-waf-token. • CAPTCHA — a visible puzzle AWS escalates to for higher-risk sessions. The most common variant is an image grid ("select every tile with a chair"). We cover the Challenge end-to-end (AntiAwsWafTask*) and the image-grid CAPTCHA as a classification step (AwsWafClassification).

The common case: a silent proof-of-work, no visible puzzle. Send just the websiteURL — we run the site's real challenge.js and return the aws-waf-token.

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiAwsWafTaskProxyLess",
        "websiteURL": "https://example.com/protected-page"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

# Step 3 — AWS WAF: set the token as the aws-waf-token COOKIE (not a header/form field)
token = result["solution"]["token"]
session = requests.Session()
session.cookies.set("aws-waf-token", token, domain="target.example.com", path="/")
resp = session.get("https://target.example.com/")
# AWS rotates aws-waf-token on each response — keep reading the refreshed cookie
print(resp.status_code)

Using your own proxy

Use AntiAwsWafTask instead of AntiAwsWafTaskProxyLess to route the solve through your own proxy — useful when the target site checks that the solving IP matches the submitting IP.

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "AntiAwsWafTask",
        "websiteURL": "https://example.com/protected-page",
        "proxyType": "http",
        "proxyAddress": "123.45.67.89",
        "proxyPort": "8080",
        "proxyLogin": "user",
        "proxyPassword": "pass"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Additional proxy parameters

Response Shape

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "token": "d6975ede-…:EQoA…:<signed aws-waf-token bound to the AWS WAF challenge>",
    "objects": [
      0,
      4,
      7
    ],
    "scores": [
      0.93,
      0.04,
      0.01,
      0.02,
      0.88,
      0.11,
      0.06,
      0.91,
      0.05
    ]
  }
}

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Pricing & Stats

Frequently asked questions

Related CAPTCHA solvers

reCAPTCHA v2Google's classic "I'm not a robot" checkbox, with image grid challenges when traffic looks suspicious.reCAPTCHA v3Google's invisible captcha that scores users from 0 (bot) to 1 (human) without any user interaction.Cloudflare TurnstileCloudflare's privacy-friendly captcha widget that verifies users without showing a challenge to most visitors.Cloudflare ChallengeCloudflare's full-page "Just a moment..." block that gates suspicious traffic before it reaches the site.DataDome SliderDataDome's inline slider / click puzzle, shown on e-commerce, ticketing and travel sites when its risk engine flags a visitor.DataDome InterstitialDataDome's full-page device-check interstitial — the "verifying you are human" block shown before the real page loads.