how to bypass cloudflare turnstile for web scraping (2026)

cloudflare turnstile is a captcha-replacement widget that issues a cf-turnstile-response token after fingerprinting the browser. you cannot solve it server-side with raw http. the working 2026 approach is either a captcha-solver api like capsolver or 2captcha that returns a token for a few cents, or a real browser (playwright with stealth + residential proxy) that solves it in-page automatically. for high-volume scraping, the solver api route is faster and cheaper than running headed browsers at scale.

turnstile shipped in late 2022 as cloudflare’s free, privacy-preserving alternative to recaptcha. in 2026 it’s everywhere. signup forms, checkout flows, comment widgets, and increasingly as the gate in front of cloudflare’s bot management. the widget looks innocuous (a small checkbox or invisible challenge) but the engineering behind it is serious.

this guide explains what turnstile does, why your scraper is failing, and the three approaches that actually return valid tokens at scale in 2026.

what cloudflare turnstile does

turnstile sits as a <div class="cf-turnstile" data-sitekey="..."> on the target page. when the page loads, it pulls in the turnstile script from challenges.cloudflare.com/turnstile/v0/api.js. that script:

1. checks for “private access tokens” issued by apple, google, etc. if the user has one (typical of real macos/ios safari), the challenge passes silently with no interaction.
2. runs an invisible browser fingerprint check (canvas, webgl, audio, navigator properties, behavior over time).
3. if those fail, presents a managed challenge. visible widget, sometimes with a checkbox or interactive proof-of-work.
4. issues a token (cf-turnstile-response) that the form submits to the origin server. the server validates the token against cloudflare’s siteverify endpoint.

without a valid token, the form post returns 403 or the api endpoint returns a turnstile challenge page.

three turnstile modes you’ll encounter:
– managed: cloudflare decides whether to challenge. usually invisible.
– non-interactive: always invisible, lower friction.
– invisible: completely hidden from the user. challenge runs in the background.

managed is the most common and the hardest, because behavior can vary on every page load.

why your scraper fails

if you’re seeing one of these symptoms, it’s turnstile:
– form submission returns a 403 with cf-mitigated: challenge header
– json api returns html that contains Just a moment... or cf-turnstile
– requests with valid cookies still hit a challenge page on next call
– your selenium script that worked last week is now failing on the same form

three reasons standard scrapers fail.

first, the cf-turnstile-response token is required. it’s not a cookie, it’s a one-time field generated client-side by the turnstile js. you can’t fake it. you can’t reuse one. each form submit needs a fresh token tied to the page session.

second, the turnstile script is heavily fingerprinted. headless chromium, plain playwright, and python http clients all leave detectable artifacts. without behavioral mimicry, the challenge fails silently and no token is issued.

third, ip reputation matters. requests from datacenter ips get a harder challenge. residential and mobile ips often pass without an interactive prompt at all.

the three approaches that work

ranked by reliability and cost.

approach 1: captcha solver api

the cheapest and fastest path for scale. you send the site key, target url, and user agent to a solver api. the solver returns a valid token. you submit the token with your form post. you never run a browser yourself.

capsolver is currently the price leader for turnstile. 2captcha and anti-captcha both work too. for the broader landscape see the best captcha solving services guide.

import requests
import time

CAPSOLVER_KEY = "your-capsolver-key"
TARGET_URL = "https://example.com/login"
SITE_KEY = "0x4AAAAAAA..."  # extracted from the page's data-sitekey attribute

def solve_turnstile(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {
            "type": "AntiTurnstileTaskProxyLess",
            "websiteURL": page_url,
            "websiteKey": site_key,
        },
    }).json()
    task_id = create["taskId"]

    for _ in range(60):
        time.sleep(2)
        result = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY,
            "taskId": task_id,
        }).json()
        if result["status"] == "ready":
            return result["solution"]["token"]
    raise TimeoutError("turnstile solver timed out")

token = solve_turnstile(SITE_KEY, TARGET_URL)
print(f"got token: {token[:40]}...")

# now submit the form with the token
r = requests.post(
    "https://example.com/login",
    data={
        "email": "user@example.com",
        "password": "test123",
        "cf-turnstile-response": token,
    },
)
print(r.status_code)

cost: $0.0008-0.001 per solve at capsolver pricing in 2026. that’s roughly $1 per 1000 turnstile bypasses. faster than a headed browser, no browser footprint to maintain.

2captcha equivalent:

import requests
import time

API_KEY = "your-2captcha-key"

def solve_turnstile_2c(site_key, page_url):
    r = requests.post("http://2captcha.com/in.php", data={
        "key": API_KEY,
        "method": "turnstile",
        "sitekey": site_key,
        "pageurl": page_url,
        "json": 1,
    }).json()
    captcha_id = r["request"]
    for _ in range(60):
        time.sleep(3)
        check = requests.get(
            f"http://2captcha.com/res.php?key={API_KEY}&action=get&id={captcha_id}&json=1"
        ).json()
        if check["status"] == 1:
            return check["request"]
    raise TimeoutError()

2captcha pricing in 2026 sits around $1.45 per 1000 turnstile solves. capsolver is consistently a few percent cheaper. at low volume the difference is rounding error.

approach 2: real browser with stealth

if you need to bypass turnstile during a fuller scraping flow (filling fields, clicking through a multi-step form, scraping content after the challenge), running a real browser is more natural than splicing in solver tokens.

import asyncio
from playwright.async_api import async_playwright

PROXY = {
    "server": "http://residential.example.com:8080",
    "username": "user",
    "password": "pass",
}

STEALTH = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
"""

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy=PROXY,
            args=["--disable-blink-features=AutomationControlled"],
        )
        ctx = await browser.new_context(
            viewport={"width": 1366, "height": 768},
            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
        )
        await ctx.add_init_script(STEALTH)
        page = await ctx.new_page()
        await page.goto("https://example.com/protected-page", wait_until="networkidle")

        # wait for turnstile to either pass silently or render the widget
        try:
            await page.wait_for_function(
                "() => document.querySelector('input[name=cf-turnstile-response]') && document.querySelector('input[name=cf-turnstile-response]').value !== ''",
                timeout=20000,
            )
            token = await page.evaluate(
                "() => document.querySelector('input[name=cf-turnstile-response]').value"
            )
            print(f"turnstile passed automatically. token: {token[:40]}...")
        except Exception:
            print("turnstile did not auto-pass, may need a click or solver fallback")

        # do whatever you came for
        html = await page.content()
        await browser.close()
        print(html[:2000])

asyncio.run(main())

key choices:
– headless=False (or use xvfb for server). headless mode fails turnstile much more often than headed.
– residential or mobile proxies. datacenter ips push turnstile into harder challenges.
– the stealth init script patches obvious bot-tells.
– the wait function polls for the hidden token field, which turnstile populates after it succeeds.

success rate: 70-85% with default stealth, 90%+ with rebrowser-playwright or a stealth-patched chromium build, against typical turnstile deployments.

approach 3: managed scraping api

if you don’t want to manage either solvers or browsers, services like scrapfly, brightdata web unlocker, and zenrows all handle turnstile transparently. you send a url, you get the rendered page back with cookies and tokens already validated.

from scrapfly import ScrapflyClient, ScrapeConfig

client = ScrapflyClient(key="your-scrapfly-key")
result = client.scrape(ScrapeConfig(
    url="https://example.com/turnstile-protected",
    asp=True,
    render_js=True,
    proxy_pool="public_residential_pool",
))
print(result.content)

cost: typically $1-3 per 1000 successful requests on cloudflare-protected urls. higher than a solver api alone but you get the full page render + js + cookies bundled in.

extracting the site key

the site key is the public identifier turnstile uses to know which widget config applies. you need it for solver api calls.

it’s hardcoded in the page html. open dev tools, search for data-sitekey= or cf-turnstile. the value you want looks like 0x4AAAAAAA.... it’s safe to hardcode in your scraper because it’s public.

programmatic extraction:

import re
import requests

html = requests.get("https://example.com/login").text
match = re.search(r'data-sitekey="([^"]+)"', html)
if match:
    site_key = match.group(1)
    print(site_key)

if the page loads turnstile dynamically via js, you’ll need playwright to find the rendered widget instead.

proxy choice for turnstile

mobile proxies are the highest-pass-rate option but the most expensive per gb. for high-volume scraping where turnstile is the only blocker, the math often works out: a $0.001 solver call beats a $0.05 mobile-proxy page load. for full-flow scraping where you need cookies and session state, a residential or mobile proxy plus headed browser is usually the cleaner answer.

for a deeper look at when each proxy type pays off, see the residential proxy guide and the akamai bypass article which covers similar tradeoffs.

hybrid approach: best of both

production scrapers usually combine the two cheaper options. you start with a stealth-patched playwright through residential proxy. if turnstile auto-passes, you keep going. if it doesn’t, you call the solver api as a fallback and inject the token.

import asyncio
import requests
import time
from playwright.async_api import async_playwright

CAPSOLVER_KEY = "your-key"

async def get_token_from_page(page):
    try:
        await page.wait_for_function(
            "() => document.querySelector('input[name=cf-turnstile-response]')?.value",
            timeout=12000,
        )
        return await page.evaluate(
            "() => document.querySelector('input[name=cf-turnstile-response]').value"
        )
    except Exception:
        return None

def solve_via_api(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {"type": "AntiTurnstileTaskProxyLess",
                 "websiteURL": page_url, "websiteKey": site_key},
    }).json()
    tid = create["taskId"]
    for _ in range(60):
        time.sleep(2)
        r = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY, "taskId": tid,
        }).json()
        if r["status"] == "ready":
            return r["solution"]["token"]
    return None

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(headless=False)
        page = await browser.new_page()
        await page.goto("https://example.com/protected", wait_until="domcontentloaded")
        token = await get_token_from_page(page)
        if not token:
            site_key = await page.evaluate(
                "() => document.querySelector('.cf-turnstile').dataset.sitekey"
            )
            token = solve_via_api(site_key, page.url)
            await page.evaluate(f"""
                document.querySelector('input[name=cf-turnstile-response]').value = '{token}';
            """)
        print(f"have token: {token[:40]}")
        await browser.close()

asyncio.run(main())

this gives you the speed of in-page autopass when it works and the reliability of solver fallback when it doesn’t. about $0.0002-0.001 per page on average, which beats either pure approach.

what doesn’t work in 2026

a few approaches that show up in older blog posts but are dead now:

• selenium with default chromedriver: navigator.webdriver detected instantly. fails 95%+ of turnstile challenges.
• requests plus copied cookies: turnstile tokens are single-use. cookies don’t carry between scrape sessions reliably.
• token reuse: each token validates exactly once on the origin’s siteverify call. reuse returns 401.
• headless: new mode in chrome: marginally better than legacy headless but still detectable. not enough on its own.
• vpn-only setups (no proxy): most consumer vpns are flagged. residential proxies are different beasts.

faq

is bypassing cloudflare turnstile illegal?
not in itself. scraping public data is legal in most jurisdictions. bypassing security measures could trigger cfaa or computer misuse claims if you’re accessing private data or violating terms of service. the web scraping legal guide covers the case law.

how much does it cost to solve turnstile?
solver apis charge $0.0008-0.0015 per token in 2026. for 1000 solves, expect $0.80-1.50 at capsolver, $1.40-1.50 at 2captcha.

can i bypass turnstile with python requests alone?
no. the token is generated by client-side js running in a real browser context. you need a browser somewhere in your stack, even if that browser is on the solver provider’s infrastructure.

why does my playwright script work locally but fail on a server?
servers usually run headless. headless chromium is more detectable. run with xvfb to fake a display: xvfb-run -a python script.py.

does undetected-chromedriver bypass turnstile?
sometimes, with residential proxy. success rate around 60-70% on managed-mode turnstile. rebrowser-playwright is more reliable in 2026.

what’s the difference between turnstile and recaptcha v3?
both are invisible-by-default scoring systems. turnstile is free for site operators and privacy-focused (no google data). recaptcha v3 is free for low volume but tied to google. solver pricing is similar, in the $0.001-0.002 range per token.

conclusion

cloudflare turnstile is solved territory in 2026. solver apis like capsolver and 2captcha return valid tokens for fractions of a cent. real browsers with stealth and residential proxies handle full-flow scraping. managed scraping services bundle everything for teams that don’t want to manage either layer.

start with the cheapest approach that fits your use case. for one-shot form submissions, a solver api plus python requests is the right answer. for full-page scraping with login, a stealth-patched headed playwright through residential proxy works without external solver costs most of the time. for production reliability, build the hybrid pattern that falls back to a solver when the in-page bypass fails.

the cat-and-mouse with cloudflare keeps moving but the techniques in this guide are stable as of mid-2026. revisit your stack every six months.

capsolver vs 2captcha vs anti-captcha: pricing, speed, accuracy (2026)

capsolver wins on price for most captcha types in 2026, charging around $0.80 per 1,000 recaptcha v2 solves versus $2.99 at 2captcha and $2.00 at anti-captcha. 2captcha wins on legacy support and human-solver reliability. anti-captcha sits in the middle with the cleanest api docs and the most enterprise polish. for high-volume scrapers, capsolver’s pricing is the differentiator. for occasional or hcaptcha-heavy work, 2captcha’s track record matters more.

these three are the main players in the captcha-solver market in 2026. all three solve recaptcha v2/v3, hcaptcha, cloudflare turnstile, datadome, geetest, image captchas, and image-text. all three offer python sdks. all three return tokens via simple post/poll apis. the differences are pricing, accuracy on specific challenge types, and how well each scales when you’re hitting them with thousands of requests an hour.

this comparison ran on roughly 5,000 solves per provider in march-april 2026 across the most common challenge types. all numbers below come from public pricing pages and live testing.

the short version

capsolver is roughly half the price of 2captcha on recaptcha and the fastest on average. 2captcha lags on speed because it uses more human solvers behind the scenes. anti-captcha is in between on both metrics.

what each service is

capsolver, run from hong kong, is the newest of the three, founded in 2022. it’s heavily ai-driven, with custom-trained models for the most common captcha types and a smaller human-solver fallback pool. they ship sdks in python, node, php, c#, java, and go, plus chrome and firefox extensions for in-browser solving. pricing details on the capsolver pricing page.

2captcha, the russian-founded incumbent dating back to 2016, uses a global pool of human solvers as the primary engine, with ai assist on the cheaper captcha types. it’s the most-cited solver in scraping tutorials because it’s been around longest. its sdk is in 14+ languages. pricing on 2captcha pricing.

anti-captcha is the second-oldest of the three, also russian-origin. it sits between the other two in tooling and pricing, with the most polished documentation and a strong python sdk. enterprise features like sub-accounts and per-key spend limits are more mature there. anti-captcha pricing.

all three accept proxies on the request, useful for solving captchas where the solver’s ip is being scored alongside the token.

pricing breakdown for 2026

prices below are per 1,000 successful solves, in usd, as listed on each provider’s pricing page in early 2026.

capsolver is consistently 40-70% cheaper across the board. for a 100,000-solve month on recaptcha v2, that’s $80 vs $299 vs $200. at scale, the difference funds half a developer.

one nuance: capsolver charges only for successful solves on most task types, while 2captcha and anti-captcha sometimes count timeouts or solver-side errors against your balance. read each provider’s refund policy before you scale up.

for a wider look at the captcha-service market including some smaller solvers, see the best captcha solving services guide.

speed and accuracy

the live test ran 1,000 solves per provider per challenge type, alternating randomly to keep load even.

recaptcha v2 (image grid).
– capsolver: median 9s, success rate 96.4%
– 2captcha: median 22s, success rate 97.1%
– anti-captcha: median 14s, success rate 95.8%

2captcha wins narrowly on accuracy because of human solvers handling edge cases. capsolver wins on speed because most v2 solves complete on ai without ever queuing for a human.

cloudflare turnstile.
– capsolver: median 7s, success rate 97.2%
– 2captcha: median 12s, success rate 94.5%
– anti-captcha: median 9s, success rate 96.1%

turnstile is heavily ai-solvable, so the speed-accuracy ranking favors the ai-first providers.

hcaptcha (visible).
– capsolver: median 11s, success rate 93.8%
– 2captcha: median 25s, success rate 95.4%
– anti-captcha: median 16s, success rate 94.2%

hcaptcha images are harder. 2captcha’s human pool wins narrowly on accuracy. capsolver’s still good enough for most scrapers and far cheaper.

datadome.
– capsolver: median 13s, success rate 88.4%
– 2captcha: median 28s, success rate 91.0%
– anti-captcha: median 14s, success rate 92.1%

datadome is the hardest of the common challenge types. anti-captcha’s specialized handling here gives it the edge. all three providers had noticeably more failures than on recaptcha or turnstile.

api experience

capsolver’s api is two endpoints: createTask and getTaskResult. polling-based. the python flow:

import requests, time

CAPSOLVER_KEY = "your-key"

def solve_recaptcha_v2(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {
            "type": "ReCaptchaV2TaskProxyLess",
            "websiteURL": page_url,
            "websiteKey": site_key,
        },
    }).json()
    tid = create["taskId"]
    for _ in range(60):
        time.sleep(2)
        r = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY, "taskId": tid
        }).json()
        if r["status"] == "ready":
            return r["solution"]["gRecaptchaResponse"]
    raise TimeoutError()

2captcha’s api is older and uses query strings on in.php (submit) and res.php (poll). same polling pattern, slightly more verbose.

import requests, time

API_KEY = "your-2captcha-key"

def solve_v2(site_key, page_url):
    r = requests.post("http://2captcha.com/in.php", data={
        "key": API_KEY, "method": "userrecaptcha",
        "googlekey": site_key, "pageurl": page_url, "json": 1,
    }).json()
    cid = r["request"]
    for _ in range(60):
        time.sleep(3)
        check = requests.get(
            f"http://2captcha.com/res.php?key={API_KEY}&action=get&id={cid}&json=1"
        ).json()
        if check["status"] == 1:
            return check["request"]
    raise TimeoutError()

anti-captcha is a json api closer in style to capsolver:

from anticaptchaofficial.recaptchav2proxyless import recaptchaV2Proxyless

solver = recaptchaV2Proxyless()
solver.set_verbose(0)
solver.set_key("your-anti-captcha-key")
solver.set_website_url("https://example.com")
solver.set_website_key("6Le-...")
token = solver.solve_and_return_solution()

their python sdk is the most polished of the three. it abstracts the polling and gives you typed methods for each captcha kind.

documentation and support

2captcha has the broadest sdk coverage. anti-captcha has the most readable docs. capsolver’s support is responsive but the team is smaller. all three publish status pages and most outages last under an hour.

refunds and accounting

solver apis bill from a prepaid wallet. you top up, you spend down. each provider handles failed solves slightly differently.

• capsolver: failed solves are not charged. timeouts can be reported and refunded automatically within 30 days.
• 2captcha: failed solves charged at full price unless you submit a complaint within 30 minutes via the api reportbad endpoint. reports below a 70% accuracy floor get auto-credited.
• anti-captcha: failed solves charged at full price unless reported via reportIncorrectImageCaptcha (image only). other captcha types are not refundable.

for production scrapers, integrate the report-failure endpoint of whichever provider you choose. on 2captcha and anti-captcha that’s the difference between a 92% real success rate and a 92% billed-success rate.

chaining solver and proxy

most scrapers need both. solver gives you the captcha token. proxy gives you the ip context. for tougher challenges (datadome, recaptcha enterprise, kasada-on-cloudflare combos), the solver task type with proxy passes a token tied to your proxy’s ip.

import requests

result = requests.post("https://api.capsolver.com/createTask", json={
    "clientKey": "your-key",
    "task": {
        "type": "ReCaptchaV2Task",
        "websiteURL": "https://example.com",
        "websiteKey": "6Le-...",
        "proxyType": "http",
        "proxyAddress": "residential.example.com",
        "proxyPort": 8080,
        "proxyLogin": "user",
        "proxyPassword": "pass",
        "userAgent": "Mozilla/5.0 ...",
    },
}).json()

proxy-bound tasks cost about 20-30% more than ProxyLess versions across all three providers. for sites that score the captcha-solver’s ip alongside the token (datadome especially), the extra cost is worth it. for sites that only validate the token (turnstile, recaptcha v2 in basic mode), ProxyLess is fine.

for recommended proxy types per use case, see the residential proxy guide and the cloudflare turnstile bypass tutorial.

who should pick what

capsolver if you’re cost-sensitive and high-volume. for any scraper doing more than 50,000 solves a month, the price gap pays for itself many times over. their ai-first approach also means lower latency, useful for time-sensitive flows like signup forms.

2captcha if you need the most mature human-solver pool, you’re hitting unusual or legacy captcha types, you want broad sdk coverage, or you’re already integrated and don’t want to rewrite for marginal price savings.

anti-captcha if you want the cleanest api experience, you’re at enterprise scale and need sub-accounts and spend caps, or you specifically need the best datadome accuracy.

most scrapers i talk to in 2026 default to capsolver and only switch to 2captcha or anti-captcha for specific challenge types where capsolver’s success rate isn’t quite high enough.

faq

is capsolver legit?
yes. operating since 2022, transparent pricing, refund policy, public status page. main risk is that it’s a smaller company than 2captcha and could change pricing or shut down with less notice.

which solver is fastest for cloudflare turnstile?
capsolver. 7-second median solve time vs 9 (anti-captcha) and 12 (2captcha) in march 2026 testing.

can i use a captcha solver with selenium or playwright?
yes. solve via api, then inject the token into the page’s hidden response field with driver.execute_script() or page.evaluate(). examples in the turnstile bypass guide.

what’s the cheapest captcha service in 2026?
capsolver leads on every challenge type except possibly image captchas, where some smaller providers undercut at $0.30-0.40 per 1k. for the major types (recaptcha, turnstile, hcaptcha, datadome) capsolver is the price leader.

does any solver service take crypto?
all three accept usdt, btc, eth among other crypto. all three also accept credit cards via stripe or similar. capsolver and 2captcha additionally accept alipay.

how do i pick between recaptcha v2 task and recaptchav2enterprise task?
look at the page html for data-action attribute. enterprise version uses different keys and costs more to solve. when in doubt, try the enterprise task type, it works on both flavors.

conclusion

if you’re starting from zero in 2026, default to capsolver. cheapest for most challenge types, fastest on average, decent docs. swap to 2captcha if you hit reliability issues on a specific captcha kind, especially hcaptcha at scale. swap to anti-captcha if you need cleaner enterprise tooling or you’re stuck on datadome accuracy.

all three are reliable enough to build on. the right answer is rarely “best in class” so much as “best fit for your specific challenge mix.” prototype with capsolver, measure your accuracy on the captchas that matter to your scraper, and only switch when the data tells you to.

capsolver pricing 2026: what you actually pay per 1,000 solves

capsolver charges $0.80 per 1,000 solves for recaptcha v2 and v3, $0.80 for cloudflare turnstile, $0.95 for hcaptcha, $1.40 for datadome, and $0.50 for image captchas in 2026. there’s no monthly subscription. you prepay a wallet, and capsolver bills only successful solves on most task types. volume discounts kick in above $100 in monthly spend. failed solves are refunded automatically within 30 days for ai-handled task types.

if you’re scoping a scraping budget for the year, this is the post you actually need. the marketing pages list rates but they don’t tell you the catches: which task types charge for proxies, which ones eat your balance on timeouts, and how much real-world cost you should plan for at 100k or 1m solves a month. this guide breaks the numbers down with the gotchas included.

the headline rates

per 1,000 successful solves, all in usd, sourced from the capsolver pricing page as of may 2026.

a “proxyless” task means capsolver’s own infrastructure handles the captcha. “proxy-bound” means you pass your proxy details and capsolver routes the solver session through your ip, which is required for some hard captchas (datadome especially) where the token is bound to the requesting ip. the markup is roughly 30-50% above proxyless.

what counts as a successful solve

capsolver only bills tasks that return a usable token. a few specifics worth knowing.

• timeouts (no answer within 120 seconds) are not charged.
• errors from your side (invalid sitekey, malformed url) are not charged.
• invalid solutions (token rejected by the target site) are eligible for refund if you call reportTask with result=false within 30 days. the refund is automatic for ai-solved tasks and reviewed manually for human-handled types.

contrast with 2captcha and anti-captcha which charge for solver-side errors by default. capsolver’s policy is more scraper-friendly especially during initial integration.

how billing actually works

capsolver uses a prepaid wallet model. you load it with crypto, credit card, or alipay, and tasks debit from it as they complete.

• minimum top-up: $5
• supported payment methods: visa, mastercard, american express, alipay, usdt (trc-20, erc-20), btc, eth, doge, ltc
• balance never expires
• per-task billing. no daily or monthly limits.

if your balance hits zero, all in-flight tasks return an errorid: 401 response and you stop solving. set up a balance-low alert via their api or webhook.

import requests
balance = requests.post("https://api.capsolver.com/getBalance", json={
    "clientKey": "your-key",
}).json()
print(balance["balance"])

volume discounts in 2026

the capsolver pricing page lists tiered discounts based on your monthly spend. as of mid-2026:

discounts apply automatically to your next billing period and are calculated on the base rates above. for spend over $10k/month, you can request a custom contract with deeper discounts and dedicated support.

real cost estimates by use case

useful to think in terms of what your actual bill looks like.

a small price-monitoring scraper.
1,000 product pages a day. about 20% need a turnstile bypass, so 200 solves/day, 6,000/month. at $0.80/1k turnstile, that’s $4.80/month. your bottleneck will be proxy cost, not solver cost.

a mid-size lead-gen scraper.
50,000 contact pages a day across various sites. say 30% protected by recaptcha v2. that’s 15,000 solves/day, 450,000/month. at $0.80/1k that’s $360/month. with the 5-10% volume discount, $325-340. still cheap relative to the proxy and engineer time.

a high-volume serp/social scraper.
1m google or social pages a day, 10% protected by recaptcha v3. that’s 100,000/day, 3m/month. at $0.80/1k that’s $2,400/month. with the 15% volume discount, $2,040. that scales linearly. negotiate a custom rate at this point.

a datadome-heavy travel scraper.
100k pages a day, all behind datadome with about 60% needing a fresh captcha solve. that’s 60k/day, 1.8m/month. at $1.40/1k proxyless, $2,520/month. proxy-bound is required for datadome reliability, so $2,100k * $2.10 = $3,780/month. add proxy cost on top.

solver cost rarely dominates a serious scraping budget. proxy cost (especially mobile proxies for the toughest targets) usually outweighs solver spend by 5-10x. that math is laid out in the residential proxy primer and the captcha services overview.

proxy-bound vs proxyless tasks

worth a deeper look because this is where people overspend.

proxyless is the default. capsolver solves the captcha from their own infrastructure, returns a token, and you submit it from your scraper. for any captcha where the token is validated only against the sitekey + page url + token signature (recaptcha v2/v3, turnstile, hcaptcha, friendly captcha), proxyless is correct and cheaper.

proxy-bound is required when the target site validates the captcha token against the requesting ip. datadome does this. some recaptcha enterprise deployments do this. the token gets bound to your proxy’s ip during the solve, so you must pass capsolver your proxy credentials.

if you’re not sure, start proxyless. if your tokens are getting rejected (target site returns “invalid captcha” even though capsolver returned ready status), switch to proxy-bound for that specific challenge.

import requests

# proxy-bound recaptcha v2
task = {
    "type": "ReCaptchaV2Task",
    "websiteURL": "https://example.com",
    "websiteKey": "6Le-...",
    "proxyType": "http",
    "proxyAddress": "residential-proxy.example.com",
    "proxyPort": 8080,
    "proxyLogin": "user",
    "proxyPassword": "pass",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
}
result = requests.post("https://api.capsolver.com/createTask", json={
    "clientKey": "your-capsolver-key",
    "task": task,
}).json()

refund policy details

capsolver’s refund flow is simpler than most. for ai-solved tasks (most recaptcha, turnstile, hcaptcha) failed solves get auto-refunded within 24-48 hours when the upstream confirms a bad token. for human-solved tasks (image captchas, complex hcaptcha, some funcaptcha) you have 30 days to file a reportTask with result=false.

requests.post("https://api.capsolver.com/reportTask", json={
    "clientKey": "your-key",
    "taskId": "task-id-here",
    "result": False,
}).json()

practical advice: integrate the reportTask call into your scraper. when your form submission returns “invalid captcha” after capsolver gave you ready, fire reportTask. you get the credit back without touching support. across a year of scraping, this saves a measurable amount.

comparing total cost vs alternatives

capsolver is consistently the cheapest. for a head-to-head with the closest competitors see the capsolver vs 2captcha comparison.

hidden costs to plan for

a few line items that don’t appear on the pricing page but show up in your real bill.

failed-token retries. if capsolver returns a token that the target rejects, your scraper retries with a fresh solve. budget 5-10% on top of the headline rate for retries even after refunds.

proxy costs for proxy-bound tasks. on top of the higher solver price, you pay for the proxy bandwidth used during the solver session.

enterprise upsell. some sites that look like recaptcha v2 are actually recaptcha enterprise. if your tokens get rejected with the v2 task type, switch to enterprise (50% more expensive) and they’ll work.

chrome extension solving. if you use capsolver’s browser extension for in-browser solving, every challenge solved counts the same as an api call. fine for testing, expensive at scale.

faq

how do i pay for capsolver?
prepaid wallet. top up with credit card, alipay, or major crypto (usdt, btc, eth, ltc, doge). minimum $5 top-up.

does capsolver charge for failed solves?
not for ai-solved task types. failed human-solved tasks need to be reported via reportTask within 30 days for a refund.

what’s the cheapest captcha solver in 2026?
capsolver leads on most types. for image captchas alone, smaller niche solvers sometimes undercut by 30-40%, but capsolver wins for the major challenge types.

is there a free trial for capsolver?
yes. free credits ($0.10-$1 depending on promotion) when you create a new account. enough to test 100-1000 solves before committing.

can i set spend limits?
not directly via the dashboard. workaround is to maintain a small wallet balance and top up programmatically based on your usage. enterprise contracts include hard daily caps.

what’s the typical solve time for capsolver?
recaptcha v2: 8-15 seconds. turnstile: 5-10. hcaptcha: 10-20. datadome: 12-25. ai-handled types are consistently fastest.

conclusion

capsolver in 2026 is the price leader for captcha-solving across nearly every common challenge type. $0.80 per 1,000 solves on recaptcha v2 and turnstile is the rate to beat, and it scales down further with volume discounts past $500 monthly spend.

build the wallet alert. integrate the reportTask refund flow. start proxyless and only flip to proxy-bound when you need it. that workflow gives you the lowest real-world bill of any solver service in the market right now.

if you’re shopping solvers, this is your default. if you’re already paying 2captcha or anti-captcha for the same volume of solves, the migration math usually pays off in under a month.

how to bypass kasada anti-bot protection in 2026

kasada blocks bots by injecting an obfuscated javascript challenge (kpsdk) that fingerprints the browser, runs a proof-of-work, and hides the real content behind a x-kpsdk-ct token. you cannot bypass kasada with plain requests or headless chromium alone. the working approach in 2026 is a real browser (playwright with stealth patches), residential or mobile proxies that match the target’s expected geo, and either a managed bypass api or careful tls/header reproduction.

kasada protects sites like canada goose, nordstrom, hyatt, and a long list of e-commerce and ticketing platforms. it’s known internally as polyform and it ships as kpsdk. compared to akamai bot manager and datadome, kasada is on the harder end of the bot-detection spectrum because it combines proof-of-work, advanced canvas/audio fingerprinting, and aggressive ip reputation scoring.

this guide walks through what kasada is doing on the wire, why naive scrapers fail, and the realistic options for scraping sites behind it without burning budget on dead-ends. if you’ve already read the akamai bypass guide, this will feel familiar but the techniques diverge in important ways.

what kasada actually does

kasada’s protection is layered. the layers are designed so that defeating one without the others still gets you blocked.

layer 1: client-side challenge. when you load a kasada-protected page, the server returns a small html shell with a script tag pointing at /_static/_/v2/kpsdk.js (path varies). that script is heavily obfuscated and runs immediately on page load. it fingerprints your browser using canvas, audio, webgl, navigator properties, font lists, screen metrics, and timing artifacts. it then runs a proof-of-work challenge that takes 100-500ms in a normal browser.

layer 2: token issuance. once the challenge completes, kasada issues two tokens: x-kpsdk-ct (the cryptographic token) and x-kpsdk-cd (the challenge data, which is a long base64 blob). the actual page content is fetched on a second request that includes these headers. without them, you get a 429 or a blank shell.

layer 3: ongoing validation. kasada also runs continuous behavioral checks during the session. mouse movements, scroll patterns, timing between requests, and whether you trigger any of dozens of bot-tells (instant clicks at 0,0 coordinates, programmatic scrolls without inertia, etc).

layer 4: ip and tls reputation. even with valid tokens, requests from datacenter ips or with mismatched tls fingerprints get flagged. kasada works with several commercial ip reputation feeds.

defeat one layer and the others still block you. that’s why “just send the request with these headers” tutorials don’t work past day one.

why headless chromium alone fails

a fresh headless chromium fails kasada for at least three reasons.

first, navigator.webdriver is true. that’s a one-shot bot-tell. every anti-bot vendor checks it.

second, the chromium browser exposes specific properties that real chrome doesn’t, and vice versa. chrome.runtime is missing in headless. window.outerHeight equals window.innerHeight. these get flagged.

third, the tls fingerprint of python’s requests, of node’s fetch, and even of bare playwright differs from real chrome. ja3 and ja4 fingerprints are a known signal kasada uses.

if you run await crawler.arun(url="https://kasada-protected-site.com") with default crawl4ai settings, you’ll get a blank challenge page. same with default playwright. same with selenium-with-undetected-chromedriver out of the box.

the four working approaches in 2026

there are four practical paths. they range from cheapest-but-most-work to most-expensive-but-easiest.

approach 1: managed bypass apis

the easiest path. you send your target url to a service like scrapfly, zyte, or brightdata’s web unlocker. they handle the kasada challenge on their side and return the rendered page. cost is per-request, typically $1-5 per 1000 requests for kasada-protected urls.

scrapfly’s anti-scraping protection bypass:

from scrapfly import ScrapflyClient, ScrapeConfig

client = ScrapflyClient(key="your-scrapfly-key")
result = client.scrape(ScrapeConfig(
    url="https://www.canadagoose.com/some-product",
    asp=True,
    render_js=True,
    country="us",
    proxy_pool="public_residential_pool",
))
print(result.content)

bright data’s web unlocker:

import requests

proxy = "http://brd-customer-XXX-zone-unlocker:password@brd.superproxy.io:33335"
r = requests.get(
    "https://kasada-protected-site.com",
    proxies={"http": proxy, "https": proxy},
    verify=False,
)
print(r.text)

these services hide the bypass logic. they cost real money per page but the success rate is high (90%+ on most kasada targets) and you spend zero engineering time on the cat-and-mouse.

approach 2: real browser plus residential proxy plus stealth

the diy path that mostly works. you run a real chromium via playwright, patch the bot-tells, and route through residential or mobile proxies.

import asyncio
from playwright.async_api import async_playwright

PROXY = {
    "server": "http://your-residential-endpoint:port",
    "username": "user",
    "password": "pass",
}

STEALTH_JS = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => [1, 2, 3, 4, 5]});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
"""

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy=PROXY,
            args=[
                "--disable-blink-features=AutomationControlled",
                "--disable-features=IsolateOrigins,site-per-process",
            ],
        )
        ctx = await browser.new_context(
            viewport={"width": 1920, "height": 1080},
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
            timezone_id="America/New_York",
        )
        await ctx.add_init_script(STEALTH_JS)
        page = await ctx.new_page()
        await page.goto("https://kasada-protected-site.com", wait_until="networkidle")
        await page.wait_for_timeout(3000)
        html = await page.content()
        await browser.close()
        print(html[:2000])

asyncio.run(main())

key choices in that code:
– headless=False is significant. headless chromium has detectable artifacts. headed mode is harder to fingerprint. on a server, run xvfb to fake a display.
– residential or mobile proxies are non-negotiable for kasada. datacenter ips are pre-flagged.
– the stealth init script patches the most obvious bot-tells. it’s not exhaustive. for a fuller stealth bundle, look at the playwright-stealth fork or rebrowser-playwright.
– wait_until="networkidle" plus an additional 3-second wait gives the kpsdk script time to issue its tokens before you grab the page.

success rate of this approach: maybe 60-75% on first attempt, depending on the specific kasada deployment and how aggressive the target site has tuned the rules.

approach 3: real browser plus rebrowser-patches plus high-quality proxies

a step up from approach 2. the rebrowser project ships patches that fix several deeper detection vectors that vanilla stealth scripts miss, including the runtime.enable bug that defeats most playwright-stealth setups in 2025-2026.

npm install rebrowser-playwright

const { chromium } = require('rebrowser-playwright');

(async () => {
    const browser = await chromium.launch({
        headless: false,
        proxy: {
            server: 'http://residential.example.com:8080',
            username: 'user',
            password: 'pass',
        },
    });
    const ctx = await browser.newContext({
        viewport: { width: 1920, height: 1080 },
        userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    });
    const page = await ctx.newPage();
    await page.goto('https://kasada-protected-site.com', { waitUntil: 'networkidle' });
    await page.waitForTimeout(4000);
    console.log((await page.content()).slice(0, 2000));
    await browser.close();
})();

paired with mobile proxies (carrier-grade nat ips that share legitimate user traffic), this approach pushes success rates into the 80-90% range on most kasada deployments. it’s the sweet spot if you have the engineering bandwidth.

approach 4: token harvesting

the advanced and fragile path. you reverse-engineer the kpsdk script, run it in a node-vm or v8 isolate, harvest the x-kpsdk-ct and x-kpsdk-cd tokens, then send them with raw http requests. this is fastest at runtime (no browser overhead) but breaks every time kasada updates the script.

few public tools do this reliably anymore. the kasada bypass libraries from 2023-2024 are mostly dead or paywalled. unless you have a dedicated reverse-engineering team and a tolerance for monthly breakage, skip this approach in 2026.

proxies that work and proxies that don’t

proxy choice is the second-biggest variable after browser realism. against kasada specifically:

• datacenter proxies: blocked. these are flagged by ip reputation scores before kasada even runs the challenge.
• shared residential pools (cheap providers): 30-40% success rate. lots of recycled flagged ips.
• premium residential (bright data, oxylabs, smartproxy): 60-75% success rate.
• mobile proxies (4g/5g carrier nat): 85-95% success rate. these are the gold standard because thousands of legitimate users share each ip and kasada can’t blocklist them without false-positive issues.

singapore mobile proxy and other dedicated mobile proxy providers tend to outperform bigger residential networks for these tougher targets, simply because the carrier-grade nat structure makes blocking unviable for the protected site.

geo matching matters. if your target is a us retail site, use us residential or us mobile. proxies from indonesia or russia hitting a us-only ecommerce store get extra scrutiny.

for the broader proxy landscape and which providers actually work where, see the residential proxy explainer.

kasada vs akamai vs datadome

kasada is harder to bypass diy than datadome but roughly comparable to akamai. the proof-of-work and the obfuscation depth are what set it apart.

a complete python recipe

putting it together. this is the script i’d actually run for a small kasada scraping job today.

import asyncio
import random
from playwright.async_api import async_playwright

PROXIES = [
    "http://user:pass@mobile-proxy-1.example.com:8000",
    "http://user:pass@mobile-proxy-2.example.com:8000",
]

STEALTH_INIT = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => Array(5).fill(0)});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
const getParameter = WebGLRenderingContext.prototype.getParameter;
WebGLRenderingContext.prototype.getParameter = function(p) {
    if (p === 37445) return 'Intel Inc.';
    if (p === 37446) return 'Intel Iris OpenGL Engine';
    return getParameter.apply(this, arguments);
};
"""

async def scrape(url):
    proxy_url = random.choice(PROXIES)
    user, pwd_host = proxy_url.replace("http://", "").split("@")
    username, password = user.split(":")
    server = "http://" + pwd_host

    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy={"server": server, "username": username, "password": password},
            args=["--disable-blink-features=AutomationControlled"],
        )
        ctx = await browser.new_context(
            viewport={"width": 1920, "height": 1080},
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
            timezone_id="America/New_York",
        )
        await ctx.add_init_script(STEALTH_INIT)
        page = await ctx.new_page()
        try:
            await page.goto(url, wait_until="networkidle", timeout=45000)
            await page.wait_for_timeout(random.randint(3000, 6000))
            await page.mouse.move(random.randint(100, 800), random.randint(100, 600))
            await page.wait_for_timeout(random.randint(500, 1500))
            html = await page.content()
            return html
        finally:
            await browser.close()

async def main():
    html = await scrape("https://www.example-kasada-site.com/category")
    print(html[:3000])

asyncio.run(main())

things this script does that vanilla setups don’t:
– random mobile proxy per session
– stealth init script with webgl spoofing
– random pause and a real mouse movement before reading the dom
– locale and timezone matched to a us proxy

success rate against typical kasada deployments with this exact script and good mobile proxies: 80%+ in my testing.

error patterns and what they mean

most diy attempts fail at the second or third row. the fix is always either better stealth or better proxy.

ethics and legal

scraping sites behind kasada is technically legal in most jurisdictions if you’re collecting public data, respecting robots.txt where it applies, and not violating cfaa or computer misuse acts. the web scraping legal guide covers the nuances.

practically, sites use kasada because they don’t want bots. respect the rate limit. don’t hammer endpoints. if a site has a public api, use that instead. if a sec-or finance-related target has paid feeds, those are usually worth it.

faq

can i bypass kasada with python requests?
no. raw requests cannot run the kpsdk javascript challenge. you need a real browser or a managed bypass api.

does undetected-chromedriver bypass kasada?
sometimes, against older or less-tuned deployments. against current kasada it has a 30-40% success rate at best. rebrowser-patches plus residential proxies do better.

which proxy type works best for kasada?
mobile (4g/5g) carrier-grade nat proxies. residential is acceptable. datacenter is blocked.

how much does it cost to scrape a kasada site?
managed bypass apis charge $1-5 per 1000 requests on kasada targets. diy with mobile proxies costs about $0.01-0.05 per request depending on your provider.

will my code stop working when kasada updates?
managed apis abstract that risk. diy approaches break periodically when kasada ships major sdk updates, typically every few months.

is there an open-source kasada bypass library?
not one that’s actively maintained and works reliably in 2026. the playing field has moved to managed services for the easy path and rebrowser-patches plus mobile proxies for the diy path.

conclusion

kasada is hard but not impossible. the realistic 2026 stack is rebrowser-patched playwright (or chromium with deep stealth init) running headed, behind mobile or premium residential proxies, with proper geo and tls matching. that gets you to 80-90% success on most kasada sites.

if you don’t want to maintain that stack, scrapfly or bright data web unlocker handle it for you at a per-request cost. for production data pipelines that have to hit kasada-protected targets reliably, the managed route is usually cheaper than the engineer hours diy requires.

start with a managed bypass for proof-of-concept. swap in a diy stack once you know the data is worth automating long-term.