Skip to content
capzy
Login

Kasada CD Tokens

Mint a fresh proof from your existing Kasada session. Generate a fresh CD proof from an already initialized Kasada session. The required values come from the active SDK and its telemetry responses.

Get the integration code
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "KasadaCaptchaCDTask",
    "site": "your-site",
    "s": "tp-v2-input0UvPrgYUBiFkJK6o",
    "ct": "02TJZTdxVJoPnlY9kWC5y4RBf5P7ONoiInuT7vPmwrspHnq5LOdhUC84fgoYsJFx84AF…",
    "st": "1782377444921",
    "fc": "eyJmZWF0dXJlRmxhZ3MiOnt9LCJkeW5hbWljQ29uZmlnIjp7ImZyb250ZW5kIjp7…"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Site identifier + platformInputs + ct + stDirect task integrationSingle-use x-kpsdk-cd

Capture the values from your session.

Generate a fresh CD proof from an already initialized Kasada session. The required values come from the active SDK and its telemetry responses.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Keep the full rotating s value.

  1. Use the supported site identifier configured for your target as site. This is a configured generator identity, rather than an arbitrary page URL.
  2. Inspect the active Kasada SDK/session for its current platformInputs. Copy the complete tp-v2-input value into s, including its suffix.
  3. Keep it from the same SDK initialization that produced the ct/st values you will send.
Input collection example - replace illustrative values
{
  "site": "YOUR_SUPPORTED_SITE",
  "s": "YOUR_COMPLETE_TP_V2_INPUT_VALUE"
}

A site name and URL cannot infer live platformInputs. The advanced GetK tool below supports explicit-key integrations.

How Kasada CD Tokens works

Kasada protects requests with two tokens: x-kpsdk-ct (the session token, reusable ~30 min) and x-kpsdk-cd — a single-use proof-of-work token that must be regenerated for every request and is consumed within ~5 seconds. Normally the Kasada SDK generates the cd inside a real browser. This task generates a valid one for you without a browser: send your current session values and get a fresh, single-use cd back in microseconds — ready to drop straight into the x-kpsdk-cd header.

Send your live session values and we return a fresh, valid x-kpsdk-cd — single-use, and accepted exactly like a browser-generated token. It comes back in microseconds with no browser, no proxy and no pool, ready to set as your x-kpsdk-cd header. You keep full control of the session; we just hand back the token for each request.

  • Browserless — pure SHA-256 compute, microseconds per CD
  • No proxy, no pool — IP-independent generation
  • You control the session (bring your own site/s/ct/st/fc); we just generate the PoW
  • Mint as many fresh CDs as you need against one session token
Advanced: retrieve the site constant k

The standard example uses the supported site identifier and current platformInputs. The extraction task can retrieve k for an explicit-key integration; keep your live ct/st and SDK context alongside it.

Use the full URL of a page that loads the Kasada SDK. This submits an extraction task using your API key; it does not change the standard site/session example above.

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

The request below follows your selected task configuration.

Request authentication

Required task inputs

Optional context

site

stringRequired

Your target site identifier — we map it to the right configuration. Example: "your-site". Contact support to add a new site.

Where it comes from

Use the supported target-site identifier configured for this generator. Contact support when the target has not been added.

Open the input guide
Example valueyour-site
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "KasadaCaptchaCDTask",
    "site": "your-site",
    "s": "tp-v2-input0UvPrgYUBiFkJK6o",
    "ct": "02TJZTdxVJoPnlY9kWC5y4RBf5P7ONoiInuT7vPmwrspHnq5LOdhUC84fgoYsJFx84AF…",
    "st": "1782377444921",
    "fc": "eyJmZWF0dXJlRmxhZ3MiOnt9LCJkeW5hbWljQ29uZmlnIjp7ImZyb250ZW5kIjp7…"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Read solution['x-kpsdk-cd'] and set x-kpsdk-cd on the protected request alongside that session's original x-kpsdk-ct, other required SDK headers, cookies, User-Agent, and proxy.

KasadaCaptchaCDTask · $1.00 / 1,000
solve_kasada_cd.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"KasadaCaptchaCDTask\",\"site\":\"your-site\",\"s\":\"tp-v2-input0UvPrgYUBiFkJK6o\",\"ct\":\"02TJZTdxVJoPnlY9kWC5y4RBf5P7ONoiInuT7vPmwrspHnq5LOdhUC84fgoYsJFx84AF…\",\"st\":\"1782377444921\",\"fc\":\"eyJmZWF0dXJlRmxhZ3MiOnt9LCJkeW5hbWljQ29uZmlnIjp7ImZyb250ZW5kIjp7…\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

Single-use x-kpsdk-cd

Read solution['x-kpsdk-cd'] and set x-kpsdk-cd on the protected request alongside that session's original x-kpsdk-ct, other required SDK headers, cookies, User-Agent, and proxy.

string
Fresh single-use proof-of-work (JSON: workTime/id/answers/duration/d/st/rst) — send as the x-kpsdk-cd header. Reuse your own ct/st/h/v from the session (or the Kasada task) for the rest of the request.
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "x-kpsdk-cd": "{\"workTime\":1782377444928,\"id\":\"b21d445994d396dbd5b2eac5e464515f\",\"answers\":[2,1],\"duration\":0.1,\"d\":0,\"st\":1782377444921,\"rst\":1782377444921}"
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Attach the fresh CD to your session request

The CD is single-use and short-lived. Reuse your existing ct and browser identity, and mint a new CD immediately before each protected request. Python session / Node context retain the existing proxy and cookie jar; sessionHeaders contains the original request headers.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python
cd = result["solution"]["x-kpsdk-cd"]
# Generate immediately before this request; keep your session's identity.
headers = {"x-kpsdk-ct": task["ct"], "x-kpsdk-cd": cd}
# Merge these into the existing session headers/cookie jar.
response = session.get("https://target.example.com/protected", headers=headers, timeout=30)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

What is `site`?

A short identifier for your target (e.g. the brand/site name). We map it to that site's Kasada challenge configuration. If your site isn't supported yet, contact support to add it.

What is `s` (platformInputs)?

It's the platformInputs string your live Kasada session is currently using. It looks like "tp-v2-input" followed by a short rotating suffix — for example tp-v2-input0UvPrgYUBiFkJK6o — and it changes frequently, so read the current value from your session and send it with each request.

Where do ct / st / fc come from?

ct and st are the x-kpsdk-ct and x-kpsdk-st values from your session's /tl response headers; fc is x-kpsdk-fc from the /mfc response (on sites that use it). Mint the session once with the browser-based Kasada task, then reuse ct/st across the ~30-min window.

How fast must I use the CD?

It's single-use and valid ~5 seconds from its workTime. Generate it immediately before sending the request.

Integration checks for Kasada CD Tokens
  • The CD is single-use and short-lived (~5 seconds from its workTime). Generate it right before the request you need it for and send it immediately.
  • Pass `site` (the target identifier) — we resolve the per-site challenge configuration. If your site isn't supported yet, contact support to add it.
  • Pass `s` (platformInputs) — the per-request value from your live Kasada session. It rotates frequently, so read it fresh from the session you're replaying against.
  • Reuse the same ct/st/User-Agent across the session that minted them — the cd binds to that session.

Related Kasada integrations

Kasada Bot Defense

Connect Kasada CD Tokens to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$1.00Per 1,000 solves
0.1sAverage solve time

KasadaCaptchaCDTask · Live configuration