Why do I need to reuse the returned user-agent?

The _abck cookie Akamai issues is tied to the browser fingerprint used while solving, including the user-agent. Sending a different user-agent on your follow-up requests can make Akamai treat the cookie as invalid even though it was generated correctly.

How long do Akamai cookies stay valid?

_abck and bm_sz typically expire within minutes to a few hours depending on the target's configuration. Solve a fresh set whenever your session needs new cookies rather than trying to reuse old ones long-term.

When should I pass akamai_script or existing cookies manually?

Passing akamai_script speeds up solving since we skip auto-detection, and passing existing _abck / bm_sz values is useful when you just need a cookie refresh instead of a brand new sensor solve.

Can I bypass Akamai Bot Manager with plain HTTP requests?

In most cases, yes: solve once to get _abck and bm_sz, then send them with the returned user-agent from your own HTTP client. Some targets also check the TLS / HTTP2 fingerprint of the client, so a client that resembles a real browser gives the best pass rates.

Akamai Solver API - Bypass Akamai Bot Manager

How it works

How the Akamai solver works

Akamai Bot Manager's sensor data challenge. We auto-detect the Akamai script, challenge, seed, and pixel from the target page and generate valid sensor data plus the _abck and bm_sz cookies your requests need.

A predictable three-step flow that stays the same even when Akamai changes its protection.

In the simplest case you only send site_url - the solver auto-detects everything else from the page. Pass the script URL or existing cookies yourself for faster solves or cookie refreshes.

01

Submit the target

Send the page URL and the challenge-specific fields in a single API request.

02

We handle the challenge

CaptchaSolv routes the task to a specialized solver and tracks it until completion.

03

Use the solution

Receive the token, headers, cookies, or sensor payload required by your next request.

Akamai API request & response

The same endpoint and response envelope across every supported solver.

POST /solve

Request

{
  "api_key": "YOUR_API_KEY",
  "type": "Akamai",
  "site_url": "https://example.com/page"}

Response200 OK

{
  "errorId": 0,
  "status": "ready",
  "solvtime": 2.15,
  "data": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "language": "en-US,en;q=0.9",
    "solution": {
      "token": "_abck=XXXXX~0~YYYYYY~-1; bm_sz=XXXXX"}
  }
}

Task data fields

Fields you can send inside the data object of a solve request for this captcha type.

akamai_scriptOptional

Akamai Bot Manager script URL. Auto-detected if omitted; passing it speeds up solving.

challenge_scriptOptional

Challenge script URL. Auto-detected if omitted.

_abckOptional

Existing _abck cookie value, for a cookie refresh instead of a fresh solve.

bm_szOptional

Existing bm_sz cookie value, for a cookie refresh.

pixelOptional

Pixel URL. Auto-detected if omitted.

seedOptional

Seed variable from the page. Auto-detected if omitted.

Solution fields

Fields returned in data.solution once the task is solved.

solution.tokenRequired

Cookie string containing _abck and the other Akamai cookies.

data.useragentRequired

Must be reused in all subsequent requests - Akamai tracks this fingerprint.

What is Akamai Bot Manager?

Akamai Bot Manager is the bot-detection layer of Akamai's CDN and security platform, used by many airlines, retailers, ticketing sites and banks. It injects a dynamic, heavily obfuscated sensor script into protected pages that collects browser fingerprint and behavioural data - device properties, timing, mouse and keyboard events - and posts it back as sensor_data.

Akamai validates that payload and updates the _abck cookie. A valid _abck, together with bm_sz and the related cookies, is what lets requests reach protected endpoints such as login, search or checkout; a session without one gets blocked or challenged. The cookies are tied to the user-agent and fingerprint that produced them, so they can't simply be shared between clients.

Generating sensor data by hand means reverse-engineering a script that changes often. Our Akamai solver does it for you: send the page URL and it detects the script, builds valid sensor data and returns the cookies ready to attach to your requests.

01
Sensor script
A dynamic, obfuscated script is injected into every protected page.
02
sensor_data
It collects fingerprint and behaviour signals and posts them to Akamai.
03
Cookie validation
Akamai scores the payload and updates _abck and bm_sz accordingly.
04
Protected requests
Requests carrying a valid _abck and the matching user-agent pass through.

Akamai cookies & fields

_abckKey

Main Bot Manager cookie - requests only get through once a valid sensor has been accepted for it.

bm_szKey

Session cookie issued with the sensor script, required alongside _abck.

sensor_dataKey

Encrypted fingerprint payload the script posts to Akamai's sensor endpoint.

ak_bmsc

Bot Manager cookie set on the first response to track the session.

bm_sv

Cookie some sites use to keep validating the session on later requests.

user-agent

Must stay identical to the one returned by the solver - the cookies are bound to it.

Step-by-step guide

How to bypass Akamai Bot Manager with the API

Akamai checks every session for a valid _abck cookie, and that cookie only becomes valid after an accepted sensor_data payload. Instead of reverse-engineering the sensor script, let the solver generate it.

01
Send the page URL
POST site_url to /solve with type Akamai. The solver finds the Bot Manager script, seed and pixel on the page by itself.
02
Speed it up (optional)
Pass akamai_script to skip auto-detection, or existing _abck / bm_sz values when you only need a cookie refresh.
03
Use the cookies
Set the returned cookie string (_abck, bm_sz, ...) on your session and send every request with the returned user-agent.
04
Solve again when needed
When the target starts rejecting the session or the cookies expire, request a fresh set instead of reusing old ones.

Akamai solver FAQ

Common questions about integrating this solver correctly.

Yes - our Akamai Bot Manager solver works on any protected site, not just a fixed list of targets. In most cases sending only site_url is enough, since the solver auto-detects the script, seed, and pixel for that specific site.

Need help?

Stuck trying to bypass Akamai?

Join our Discord and our team will help you get Akamai solving working in your setup - free advice on handling it programmatically, even as the challenge changes over time.

Join our Discord