Skip to content
capzy
Login

Cloudflare Challenge

Get past the waiting page with session clearance. Start with the full-page Cloudflare check and the network your client will continue using. This task needs a protected URL and proxy, rather than a widget site key.

Get the integration code
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiCloudflareTask",
    "websiteURL": "https://example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Protected URL + your proxyYour session proxy requiredcf_clearance + browser identity

Start with the blocked page.

Start with the full-page Cloudflare check and the network your client will continue using. This task needs a protected URL and proxy, rather than a widget site key.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Use the URL that returned the waiting page.

  1. Open DevTools → Network, enable Preserve log, and reload the protected page through your session proxy.
  2. Select the document request that shows the Cloudflare check. In Headers, copy its complete Request URL into websiteURL, including the path and query.
  3. If you are supplying html, copy that request's raw Response body. Keep it as a string; the HTML is optional context.
Input collection example - replace illustrative values
{
  "websiteURL": "https://example.com/account",
  "html": "<html>...captured challenge response...</html>"
}

The page URL is the input. A Turnstile token and cf_clearance are different outputs; select the solver for the flow you actually have.

Provider integration documentation
How Cloudflare Challenge works

Cloudflare Challenge is the full-page block that sites show when Cloudflare's bot-management layer decides your IP needs to prove it's a real browser. Titles include 'Just a moment...', 'Checking your browser before accessing', or 'Attention Required!'. Unlike Turnstile (a widget that returns a token), this is a hard block that produces a cf_clearance cookie once cleared. The cookie is valid for 30 minutes and is cryptographically bound to the exact IP that solved the challenge. Any request to the site from a different IP will fail even with the cookie.

Capzy's proprietary infrastructure handles the Cloudflare Challenge using YOUR provided proxy — there's no proxyless variant because the resulting cookie can't be transferred between IPs. We return the cf_clearance cookie along with the exact user-agent and headers used, so your client can replay them. Intended for authorized QA, accessibility testing, and automation against sites you own or are permitted to test.

  • Returns cf_clearance cookie + matching user-agent
  • Handles hybrid challenge pages with embedded Turnstile
  • Capzy proprietary infrastructure — high-quality solves
  • Works on hard-gated sites that use Cloudflare's strictest Challenge variants
  • Cookie valid for 30 minutes on the solving IP

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Keep your proxy exit and session identity consistent when using this result.

Request authentication

Required task inputs

Optional context

Proxy connection

websiteURL

stringRequired

The URL of the page showing the Cloudflare challenge

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide
Example valuehttps://example.com/
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiCloudflareTask",
    "websiteURL": "https://example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Merge solution.cookies into the existing session and reuse solution.userAgent through the same proxy. solution.cf_clearance is a cookie value; place it in the cookie jar before retrying the protected request.

AntiCloudflareTask · $1.20 / 1,000
solve_cloudflare_challenge.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AntiCloudflareTask\",\"websiteURL\":\"https://example.com/\",\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

cf_clearance + browser identity

Merge solution.cookies into the existing session and reuse solution.userAgent through the same proxy. solution.cf_clearance is a cookie value; place it in the cookie jar before retrying the protected request.

string
The cf_clearance cookie value — set this as the cf_clearance cookie on the target domain
string
Alias for token (same value)
object
All target-domain cookies issued during the solve, as {name: value}. Set these alongside cf_clearance for best compatibility
string
The exact user-agent the solver used. You MUST use this UA on subsequent requests — any mismatch invalidates the cookie
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "token": "<cf_clearance cookie value>",
    "cf_clearance": "<same as token — alias>",
    "cookies": {
      "cf_clearance": "<value>",
      "__cf_bm": "<value>"
    },
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Continue with the clearance cookies

solution.cookies is an object, not an array. Install all returned cookies, preserve the returned user-agent, and use the solve's proxy. Browser/TLS identity must also match; ordinary HTTP clients can still be rejected. The Node.js fragment uses your existing Playwright context.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python
from curl_cffi import requests as browser_requests

sol = result["solution"]
cookies = dict(sol.get("cookies", {}))  # This result is a name/value object.
cookies["cf_clearance"] = sol.get("cf_clearance") or sol["token"]
# Install curl_cffi; match the returned browser identity/TLS profile.
response = browser_requests.get("https://target.example.com/",
    cookies=cookies,
    headers={"User-Agent": sol["userAgent"]},
    proxy="http://USER:PASS@PROXY_HOST:PORT",  # Same proxy as the solve.
    impersonate="chrome", timeout=30,
)
print(response.status_code)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

Why do I need to use the same proxy?

cf_clearance is cryptographically tied to the IP that solved the challenge. Cloudflare checks every request against the issuing IP, so a cookie earned on our pod's IP won't work from your machine unless both route through the same proxy.

Can I reuse one cf_clearance across many requests?

Yes, for ~30 minutes, as long as every request uses the same IP, user-agent, and TLS fingerprint. After that the cookie expires and Cloudflare re-challenges.

What's the difference between this and Turnstile?

Turnstile is a widget that sits in a form and produces a one-time token. Cloudflare Challenge is a full-page block that gates access to the entire site and produces a cookie. Some sites use both — solve Turnstile for the form token, then use Cloudflare Challenge to bypass the initial block.

Will the token work with requests/httpx/fetch?

Not reliably. Cloudflare inspects TLS fingerprints and rejects clients that don't match a real Chrome TLS handshake. Use curl_cffi (ja3 impersonation) or tls-client in Python, or a headless browser.

Integration checks for Cloudflare Challenge
  • Proxy is REQUIRED. AntiCloudflareTaskProxyLess is permanently disabled — we'll return ERROR_PROXY_REQUIRED if you submit it. The reason is fundamental: cf_clearance is IP-bound, so a cookie produced on our IP is useless from yours. Use AntiCloudflareTask with a static or sticky proxy you control.
  • Use the same proxy on subsequent requests. Switching IPs (rotating proxies, networks) invalidates the cookie immediately.
  • Use the userAgent we return — it is the contract. Cloudflare cross-checks the User-Agent against Client Hints and the TLS/JA3 fingerprint, so any mismatch re-triggers the challenge. Pin the value we send back into your HTTP client.
  • We do NOT spoof an arbitrary user-agent you pass in. Overriding only the UA string leaves Client Hints and TLS reporting a different browser — Cloudflare treats that as incoherent and withholds clearance. We solve with a real, coherent browser and hand you its exact UA to match.
  • Use a modern Chrome-matching TLS stack for replay. Python's default urllib TLS is rejected; use a recent build of curl_cffi / tls-client (matched to the returned UA's Chrome major) or a real browser session. An out-of-date impersonation can still draw a fresh challenge.

Connect Cloudflare Challenge to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$1.20Per 1,000 solves
8.9sAverage solve time

AntiCloudflareTask · Live configuration