TurnstileTask / Cloudflare Challenge

All Turnstile subtypes are automatically supported: manual, non-interactive и invisible. Therefore, there is no need to specify a subtype for a normal captcha.

Attention!

If you solve Turnstile on the cloudflare 5s challenge pages, don’t forget to specify cloudflareTaskType and related fields. userAgent is required.

Object structure

Parameter	Type	Required	Value
type	String	yes	TurnstileTask
websiteURL	String	yes	The page address, where the captcha is solved
websiteKey	String	yes	Turnstile key
proxyType	String	yes	http - regular http/https proxy https - try this option only if "http" doesn’t work (required for some custom proxies) socks4 - socks4 proxy socks5 - socks5 proxy
proxyAddress	String	yes	The IP address of the IPv4/IPv6 proxy. Not allowed: using hostnames using transparent proxies (where you can see the client's IP) using proxies on local machines
proxyPort	Integer	yes	Proxy port
proxyLogin	String	no	Proxy login
proxyPassword	String	no	Proxy password
cloudflareTaskType	String	no	cf_clearance - if cookies are required; token - if required token from Turnstile
htmlPageBase64	String	yes, if cloudflareTaskType is equal to cf_clearance	Base64 encoded html page with captcha.
userAgent	String	yes, if cloudflareTaskType is specified.	Only the latest UAs from Chrome are supported.
pageAction	String	yes, if cloudflareTaskType is equal to token	The `action`field, that can be found in the callback function to load the captcha. If cloudflareTaskType is used, then `action`, is usually “managed“ or “non-interactive“.
data	String	yes, if cloudflareTaskType is equal to token	The value of the data field can be taken from the `cData` parameter.
pageData	String	yes, if cloudflareTaskType is equal to token	The value of the pageData field can be taken from the `chlPageData` parameter.

Proxy for token method is not required.

These parameters are in the object that is passed during captcha creation in window.turnstile.render(el, paramsObj) function. You can get them, for example, by executing JavaScript before loading other scripts:

(function () {
  const obj = {
    render: function () {
      const { action, cData, chlPageData } = arguments[1];
      const params = [
        ["action", action],
        ["data", cData],
        ["pageData", chlPageData],
      ];
      console.table(params)
    }
  };

  Object.defineProperty(window, "turnstile", {
    get: () => {
      return obj;
    },
  });
})();

Request examples

Normal Turnstile:

Address https://api.capmonster.cloud/createTask

{
    "clientKey":"dce6bcbb1a728ea8d871de6d169a2057",
    "task":
    {
        "type":"TurnstileTask",
        "websiteURL":"http://tsmanaged.zlsupport.com",
        "websiteKey":"0x4AAAAAAABUYP0XeMJF0xoy"
        "proxyType":"http",
        "proxyAddress":"8.8.8.8",
        "proxyPort":8080,
        "proxyLogin":"proxyLoginHere",
        "proxyPassword":"proxyPasswordHere"
    }
}

Response example

{
    "errorId":0,
    "taskId":407533072
}

Cloudflare challenge

Address https://api.capmonster.cloud/createTask

Getting a result

Use the getTaskResult method to get the Turnstile solution. Depending on the system load, you will receive a response after a time ranging from 5 to 20 seconds.

Property	Type	Description
cf_clearance	String	Special cloudflare cookies, that you can set
token	String	Pass this token to the callback function

When specify `cloudflareTaskType` and when not? Or how to distinguish a normal Turnstile from a Cloudflare Challenge.

Cloudflare Challenge may look different.

Simple variant:

Stylized variants:

The challenge is organically built into the website

To finally verify the presence of Cloudflare, you can open the developer tools, see the traffic, examine the page code and see the characteristic features:

The first request to the site returns a 403 code:

The form with the id challenge-form has an action attribute, containing the __cf_chl_f_tk= parameter:
There are two similar <script> tags on the page that create a new value in the window object: