Where do I find forter_js_url and site_id?

Open DevTools on the target checkout or login page and search the page source for 'forter.com'. You will find a script tag like . The full src is forter_js_url and the 12-hex segment in the path (cbf12a88ccce) is site_id.

Which header do I send the token on?

Set x-forter-token: as an HTTP header on your checkout or order API request. Some implementations also accept it as the forterToken cookie. Check the target site's outgoing requests in DevTools to see which format is used.

Why is a proxy required?

Forter embeds the egress IP into the fingerprint. The IP used during token generation must match the IP that calls the merchant's server, or Forter flags the session as suspicious. Use a residential proxy that you also use for the final checkout/order request.

How long is the token valid?

Forter is a persistent device fingerprint — the forterToken cookie is written with a multi-year expiry. What matters is coherence, not age: replay the token from the SAME IP it was minted under (Forter is IP-scored) and the same User-Agent.

Can I reuse the token?

Yes — it is a device identifier, not a single-use nonce, and can be sent on multiple requests in the same session. Forter's script updates the token value as it collects more data, so send the latest value you have. Re-minting every few seconds is unnecessary and can itself look anomalous.

Can I set my own User-Agent?

Yes. Pass userAgent and we fingerprint the browser with that exact UA, then return the same value in the solution. Send that User-Agent on your checkout/order request so the token, IP, and UA all line up. If you leave it out, we generate a fresh Windows fingerprint per solve and return its User-Agent for you to reuse.

Before you submit — these must be correct

If any of these are wrong, your token may be accepted by our solver but rejected or scored poorly by the target site.

Use the same proxy for the Forter solve AND your follow-up checkout/order request. The token is IP-bound — a different exit IP will cause Forter to flag the session.
Include the returned User-Agent on your follow-up request for full fingerprint coherence.
The forterToken is a long-lived device fingerprint — replay it from the same IP and User-Agent it was minted under. Re-minting every few seconds is unnecessary.
Forter scores the whole SESSION, not just the token. It expects its forter.js to run live in the browser that submits the order (continuous behavioral beacons). A token minted in one browser and replayed by another — especially a browser that blocks forter.js — may be accepted but scored as high-risk (order confirmed, then reversed). For best results the token, live forter.js, IP, and order request should all come from one coherent session.

Forter Token

ForterTask

proxy required

Forter Token Solver, solved in 5.0s.

Collect Forter device-fingerprinting tokens from forter.js automatically. We load the script in a real browser with your proxy and return the ftr:tokenReady token for checkout or login.

Get API Key Try Demo Examples

Avg Speed~5.0s

Success99%+

Cost / 1k$2.00

Throughput12/m

Forter (forter.com) is a commerce security platform used by major retailers for fraud prevention. It injects a small forter.js script on checkout and login pages that continuously fingerprints the device and behaviour and produces a signed token. The merchant sends this token with the order — Forter's API returns an approve, decline, or challenge verdict. The token is delivered via the ftr:tokenReady DOM event fired by forter.js, and is also written to the forterToken cookie (a multi-year device identifier). Tokens are bound to the IP used during fingerprinting, so a residential proxy is required — and Forter scores the whole session, so the token works best when it is replayed from a coherent session (same IP and User-Agent).

Quick Integration

solve.py

import requests, time

API = "https://api.capzy.ai"
KEY = "capzy_your_key_here"

# Step 1: Create task
task = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "ForterTask",
        "task_type": "ForterTask",
        "target_url": "https://www.arcteryx.com/us/en/checkout",
        "forter_js_url": "https://cdn.forter.com/cbf12a88ccce/forter.js",
        "site_id": "cbf12a88ccce",
        "proxyType": "http",
        "proxyAddress": "ip",
        "proxyPort": "port",
        "proxyLogin": "username",
        "proxyPassword": "password"
    }
}).json()

task_id = task["taskId"]
print(f"Task created: {task_id}")

# Step 2: Poll for result
while True:
    result = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY,
        "taskId": task_id
    }).json()

    if result["status"] == "ready":
        print("Solved!", result["solution"])
        break
    elif result["status"] == "failed":
        print("Failed:", result.get("errorDescription"))
        break

    time.sleep(1)

Using the result

use_result.py

# Step 3: Use the result — paste the token into the site's captcha form field
token = result["solution"]["token"]
# Browser side: set the textarea value or the hidden input. Then submit.
# Server-to-server: post the token alongside the form fields you normally send.
resp = requests.post("https://target.example.com/submit", data={
    "username": "...",
    "captcha_response": token,   # <-- replace with the field name your site uses
})
print(resp.status_code)

1. Send Payload

Dispatch your ForterTask to our processing cluster via the secure API endpoint.

2. Solving Engine

We launch a self-owned capium browser with your residential proxy and navigate to the real target page. Before forter.js loads, we install a ftr:tokenReady listener and block WebRTC RTCPeerConnection to prevent IP leaks through STUN. We then dynamically inject forter_js_url and wait for the token event. The forterToken cookie is used as a fallback if the event misses.

3. Get Result

Poll getTaskResult for the validated token, then finalize your automated request.

Task Parameters

API Spec

Proxy fields below are required for this captcha — userAgent must match the one you’ll use when submitting the resulting token.

fieldtyperequireddescription

target_urltypestringreqrequiredFull URL of the page where Forter is active (e.g. the checkout or login page).

forter_js_urltypestringreqrequiredFull URL to the site's forter.js bundle (e.g. https://cdn.forter.com/cbf12a88ccce/forter.js). Find it in the page source — it includes the site's ID in the path.

site_idtypestringreqrequiredForter site ID (12 hex characters, e.g. cbf12a88ccce). Embedded in the forter_js_url path.

userAgenttypestringreqoptionalOptional. The User-Agent to mint the token under. We fingerprint with this exact UA and return it back, so you replay the same one on your checkout request. If omitted, we use a fresh Windows fingerprint and return its User-Agent for you to reuse.

cookiestypestringreqoptionalOptional session cookies to load before forter.js runs, so the token is generated inside your real logged-in or checkout context. Accepts a list of { name, value } objects, a name-to-value object, or an "a=b; c=d" cookie string.

proxyTypetypestringreqrequiredProxy protocol: http, https, socks4, or socks5

proxyAddresstypestringreqrequiredProxy IP address or hostname

proxyPorttypenumberreqrequiredProxy port number

proxyLogintypestringreqoptionalProxy username (if auth required)

proxyPasswordtypestringreqoptionalProxy password (if auth required)

userAgenttypestringreqoptionalUser-Agent string to use. Must match the UA you use when submitting the token

Response Shape

fieldtypedescription

tokentypestringThe Forter token from ftr:tokenReady. Send as x-forter-token header or forterToken cookie on your checkout/order request.

userAgenttypestringThe User-Agent used during fingerprinting. Include it on your follow-up request.

Example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "token": "4a7fb2c09d123456789abcdef01234ab_1722345678901_0_ftr_1",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ..."
  }
}

Error response

{
  "errorId": 1,
  "errorCode": "ERROR_CAPTCHA_UNSOLVABLE",
  "errorDescription": "Solver gave up."
}

Features

Real capium browser — forter.js fingerprinting looks identical to a genuine device visit

WebRTC blocked: RTCPeerConnection is disabled before forter.js loads to prevent STUN IP leak

ftr:tokenReady listener installed before script injection — no race condition

forterToken cookie fallback if the DOM event fires before the listener attaches

Fresh randomized Windows device fingerprint per solve — no reused device profile

Bring your own User-Agent: we mint the token under it and return it for replay

No shared pool — each solve gets its own isolated browser instance and proxy IP

Pricing & Stats

Per 1,000 solves$2.00

Avg solve time~5.0s

Success rate99%+