APIsCaptcha Task TypesTurnstileTask / Cloudflare Challenge

TurnstileTask / Cloudflare Challenge

Owned by ZL Support
Last updated: Nov 20, 2023

All Turnstile subtypes are automatically supported: manual, non-interactive и invisible. Therefore, there is no need to specify a subtype for a normal captcha.

Attention!

If you solve Turnstile on the cloudflare 5s challenge pages, don’t forget to specify cloudflareTaskType and related fields. userAgent is required.

Object structure

Parameter

Type

Required

Value

type

String

yes

TurnstileTask

websiteURL

String

yes

The page address, where the captcha is solved

websiteKey

String

yes

Turnstile key

proxyType

String

yes

http - regular http/https proxy
https - try this option only if "http" doesn’t work (required for some custom proxies)
socks4 - socks4 proxy
socks5 - socks5 proxy

proxyAddress

String

yes

The IP address of the IPv4/IPv6 proxy. Not allowed:

  • using hostnames

  • using transparent proxies (where you can see the client's IP)

  • using proxies on local machines

proxyPort

Integer

yes

Proxy port

proxyLogin

String

no

Proxy login

proxyPassword

String

no

Proxy password

cloudflareTaskType

String

no

cf_clearance - if cookies are required;
token - if required token from Turnstile

htmlPageBase64

String

yes, if cloudflareTaskType is equal to cf_clearance

Base64 encoded html page with captcha.

userAgent

String

yes, if cloudflareTaskType is specified.

Only the latest UAs from Chrome are supported.

pageAction

String

yes, if cloudflareTaskType is equal to token

The actionfield, that can be found in the callback function to load the captcha.
If cloudflareTaskType is used, then action, is usually “managed“ or “non-interactive“.

data

String

yes, if cloudflareTaskType is equal to token

The value of the data field can be taken from the cData parameter.

pageData

String

yes, if cloudflareTaskType is equal to token

The value of the pageData field can be taken from the chlPageData parameter.

Proxy for token method is not required.

These parameters are in the object that is passed during captcha creation in window.turnstile.render(el, paramsObj) function. You can get them, for example, by executing JavaScript before loading other scripts:

(function () { const obj = { render: function () { const { action, cData, chlPageData } = arguments[1]; const params = [ ["action", action], ["data", cData], ["pageData", chlPageData], ]; console.table(params) } }; Object.defineProperty(window, "turnstile", { get: () => { return obj; }, }); })();

Request examples

Normal Turnstile:

Address https://api.capmonster.cloud/createTask

{ "clientKey":"dce6bcbb1a728ea8d871de6d169a2057", "task": { "type":"TurnstileTask", "websiteURL":"http://tsmanaged.zlsupport.com", "websiteKey":"0x4AAAAAAABUYP0XeMJF0xoy" "proxyType":"http", "proxyAddress":"8.8.8.8", "proxyPort":8080, "proxyLogin":"proxyLoginHere", "proxyPassword":"proxyPasswordHere" } }

Response example

{ "errorId":0, "taskId":407533072 }

 

Cloudflare challenge

Address https://api.capmonster.cloud/createTask

{ "clientKey":"dce6bcbb1a728ea8d871de6d169a2057", "task": { "type":"TurnstileTask", "websiteURL":"https://nowsecure.nl", "websiteKey":"0x4AAAAAAADnPIDROrmt1Wwj" "proxyType":"http", "proxyAddress":"8.8.8.8", "proxyPort":8080, "proxyLogin":"proxyLoginHere", "proxyPassword":"proxyPasswordHere", "cloudflareTaskType": "cf_clearance", "htmlPageBase64": "PCFET0NUWVBFIGh0...vYm9keT48L2h0bWw+", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" } }

Getting a result

Use the getTaskResult method to get the Turnstile solution. Depending on the system load, you will receive a response after a time ranging from 5 to 20 seconds.

Property

Type

Description

cf_clearance

String

Special cloudflare cookies, that you can set

token

String

Pass this token to the callback function

When specify cloudflareTaskType and when not? Or how to distinguish a normal Turnstile from a Cloudflare Challenge.

Cloudflare Challenge may look different.

Simple variant:

Stylized variants:

The challenge is organically built into the website
It looks like simple turnstile, but it’s a cloudflare challenge

To finally verify the presence of Cloudflare, you can open the developer tools, see the traffic, examine the page code and see the characteristic features:

  • The first request to the site returns a 403 code:

  • The form with the id challenge-form has an action attribute, containing the __cf_chl_f_tk= parameter:

  • There are two similar <script> tags on the page that create a new value in the window object:

const { Builder } = require('selenium-webdriver'); const chrome = require('selenium-webdriver/chrome'); (async function example() { const options = new chrome.Options(); options.addArguments('--auto-open-devtools-for-tabs') const driver = new Builder() .forBrowser('chrome') .setChromeOptions(options) .build(); try { driver.executeScript(` window.turnstile = new Proxy(window.turnstile, { get(target, prop) { if (prop === 'render') { return function(a, b) { let p = { type: "TurnstileTaskProxyless", websiteKey: b.sitekey, websiteURL: window.location.href, data: b.cData, pagedata: b.chlPageData, action: b.action, userAgent: navigator.userAgent } console.log(JSON.stringify(p)) window.params = p; window.turnstileCallback = b.callback; return target.render.apply(this, arguments); } } return target[prop]; } }); `) driver.get('SITE WITH CAPTCHA'); const params = await driver.executeScript(` return new Promise((resolve, reject) => { setTimeout(() => { resolve(window.params) }, 2000) }) `); if (params) { const data = { clientKey: 'API KEY', task: { type: 'TurnstileTaskProxyless', websiteURL: params.websiteURL, websiteKey: params.websiteKey, data: params.data, action: params.action } } const createResult = await fetch('https://api.capmonster.cloud/createTask', { method: 'post', body: JSON.stringify(data) }); const createTaskResult = await createResult.json() if (createTaskResult.taskId) { const asyncDelay = (timeout) => new Promise(resolve => { setTimeout(() => { resolve(); }, timeout); }); const getTaskResult = async (taskId) => { const taskResult = await fetch('https://api.capmonster.cloud/getTaskResult', { method: 'post', body: JSON.stringify({ "clientKey":"API KEY", "taskId": createTaskResult.taskId }) }); const taskResponse = await taskResult.json(); if (taskResponse.status === 'processing') { await asyncDelay(5000); return await getTaskResult(taskId) } return taskResponse; } const taskRes = await getTaskResult(createTaskResult.taskId) if (taskRes.solution) { await driver.executeScript(` window.turnstileCallback(${taskRes.solution.token}); `); } } } //DO SOMETHING } finally { await driver.quit(); } })();