Kasada Bot Defense

Get the headers and browser context for your next request. Use the Kasada-protected page and a proxy your client can retain. The result is a coherent header and cookie set for a continued browser session.

Get the integration code

POST /createTask · example

{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "KasadaCaptchaTask",
    "websiteURL": "https://www.example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Protected URL + your proxyYour session proxy requiredKasada headers + cookies + identity

Start with the Kasada-protected URL.

Use the Kasada-protected page and a proxy your client can retain. The result is a coherent header and cookie set for a continued browser session.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Choose the document that loads Kasada.

Open Network with Preserve log and navigate to the page used by the protected action. Look for Kasada SDK/telemetry requests such as /tl.
Copy the full parent page URL into websiteURL. This browser task loads the protection flow; it does not need a public widget key.
Keep the original action's application headers and cookies available for replay.

Input collection example - replace illustrative values

{
  "websiteURL": "https://example.com/account"
}

For generation from existing live ct/st/platformInputs, use the separate Kasada CD guide.

How Kasada Bot Defense works

Kasada is a bot defense platform that uses a custom JavaScript VM (ips.js) to fingerprint browsers and generate proof-of-work tokens. Kasada uses two tokens: x-kpsdk-ct (client token, ~30 min lifetime) and x-kpsdk-cd (single-use per-request proof-of-work).

Capzy's proprietary solver returns the Kasada x-kpsdk-ct + x-kpsdk-cd tokens and KP_UIDz session cookies needed for protected requests. Designed for authorized testing and automation.

~1.6 second solve time
Captures x-kpsdk-ct + x-kpsdk-cd + cookies
Capzy proprietary infrastructure — high-quality solves
Returns the full token chain (ct + cd + cookies) in one request
CT reusable for ~30 minutes

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Keep your proxy exit and session identity consistent when using this result.

Request authentication

Required task inputs

Optional context

Proxy connection

`websiteURL`

stringRequired

A page URL on the Kasada-protected domain. Include www and a trailing slash (e.g. https://www.example.com/); a bare apex domain may not arm the challenge.

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide

Example valuehttps://www.example.com/

POST /createTask · selected configuration

{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "KasadaCaptchaTask",
    "websiteURL": "https://www.example.com/",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples

Create the task
Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.
Wait for the solution
Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.
Apply the result
Use all returned x-kpsdk-* headers and Client Hints, merge cookies, and pin userAgent in the same proxy session. The CD proof is only one part of the returned bundle.

KasadaCaptchaTask · $2.00 / 1,000

solve_kasada.py

import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"KasadaCaptchaTask\",\"websiteURL\":\"https://www.example.com/\",\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

Kasada headers + cookies + identity

Use all returned x-kpsdk-* headers and Client Hints, merge cookies, and pin userAgent in the same proxy session. The CD proof is only one part of the returned bundle.

string: Client token (~30 min lifetime, reusable)
string: Client data with proof-of-work (single-use per request)
string: Integrity header (static per client version). Send it on every protected request — omitting it is rejected with 429.
string: Kasada client version. Send it alongside x-kpsdk-h.
string: User-Agent used during solve — reuse it as the user-agent header on subsequent requests
string: Client Hints brand header, coherent with the User-Agent — send it to match the token's fingerprint.
string: Client Hints platform header — send it with sec-ch-ua.
object: KP_UIDz and KP_UIDz-ssn session cookies
number: Unix timestamp when the CT expires

POST /getTaskResult · example response

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "x-kpsdk-ct": "<client token (CT) — ~30 min lifetime, reusable>",
    "x-kpsdk-cd": "<client data (CD) — single-use proof-of-work per request>",
    "x-kpsdk-h": "01LAYcQHBsrRxyq9ja+CNVxPZlQ9g=",
    "x-kpsdk-v": "j-1.2.616",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
    "sec-ch-ua": "\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\", \"Google Chrome\";v=\"150\"",
    "sec-ch-ua-platform": "\"Windows\"",
    "cookies": {
      "KP_UIDz": "<value>",
      "KP_UIDz-ssn": "<value>"
    },
    "expiresAt": 1735691400
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Use the result

Use all returned x-kpsdk-* headers and Client Hints, merge cookies, and pin userAgent in the same proxy session. The CD proof is only one part of the returned bundle.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python


sol = result["solution"]
headers = {name: value for name, value in sol.items()
           if (name.lower().startswith("x-kpsdk-") or name.lower() in ("sec-ch-ua", "sec-ch-ua-platform")) and value}
headers["User-Agent"] = sol["userAgent"]
for name, value in sol.get("cookies", {}).items():
    if value:
        session.cookies.set(name, value, domain="target.example.com", path="/")
# CD is single-use; session retains the solve proxy and original cookies.
resp = session.get("https://target.example.com/", headers=headers, timeout=30)
print(resp.status_code)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

How do I use the tokens?

Add x-kpsdk-ct, x-kpsdk-cd, x-kpsdk-h and x-kpsdk-v as HTTP headers on your requests, along with the returned sec-ch-ua / sec-ch-ua-platform and the exact same User-Agent. Set the KP_UIDz cookie to the ct value. Missing x-kpsdk-h or x-kpsdk-v is rejected with a 429.

x-kpsdk-cd is single-use. How do I get more?

The CT (client token) lasts ~30 minutes. For each subsequent request, you'll need a fresh CD. Create a new task with the same URL to get one — or use the Kasada CD task for a guaranteed CD each call.

Does ProxyLess work?

Yes for most sites. Higher-security Kasada deployments may require your own proxy via the Task variant.

Integration checks for Kasada Bot Defense

Use the full page URL including www and a trailing slash (e.g. https://www.example.com/), pointing at a real Kasada-protected page. A bare apex domain may not load the Kasada challenge, so no tokens come back.

Related Kasada integrations

Kasada CD Tokens

Connect Kasada Bot Defense to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation

$2.00Per 1,000 solves

6.3sAverage solve time

KasadaCaptchaTask · Live configuration