Castle Solver API
Integrate Castle solving into your automation through one stable REST endpoint. Send the target details and receive a ready-to-use solution without maintaining custom bypass logic.
Castle, without custom bypass code.
A predictable three-step flow that stays the same even when Castle changes its protection.
Send the Castle publishable key from the page and, if relevant, the event name for the action you're protecting (e.g. $login.succeeded). We return the X-Castle-Request-Token header value and a __cuid device id to send along with your request.
Submit the target
Send the page URL and the challenge-specific fields in a single API request.
We handle the challenge
CaptchaSolv routes the task to a specialized solver and tracks it until completion.
Use the solution
Receive the token, headers, cookies, or sensor payload required by your next request.
The same endpoint and response envelope across every supported solver.
{
"api_key": "YOUR_API_KEY",
"type": "Castle",
"site_url": "https://example.com/login",
"data": {
"pub_key": "pk_XXXXXXXXXXXXXXXXXXXXXXXX",
"event": "$login.succeeded"}
}{
"errorId": 0,
"status": "ready",
"solvtime": 1.94,
"data": {
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
"language": "en-US,en;q=0.9",
"solution": {
"request_token": "eyJkYXRhIjoiZXlKe...",
"cuid": "d290f1ee-6c54-4b01-90e6-d701748f0851"}
}
}Fields you can send inside the data object of a solve request for this captcha type.
pub_keyRequiredThe Castle publishable key loaded by the page's Browser SDK, prefixed pk_.
eventOptionalThe activity name being protected, e.g. $login.succeeded or $registration.succeeded. Improves signal accuracy when supplied.
Fields returned in data.solution once the task is solved.
solution.request_tokenRequiredSend as the X-Castle-Request-Token header on the protected request.
solution.cuidOptionalDevice id to send as the __cuid cookie, for continuity across requests from the same simulated device.
data.useragentRequiredThe user-agent used while generating the token - reuse it on the protected request.
Common questions about integrating this solver correctly.
Yes - it works on any site using Castle's device fingerprinting and risk API, not just a fixed list of targets. Send the publishable key from the page you're hitting and we generate a valid request token for that specific integration.
Stuck trying to bypass Castle?
Join our Discord and our team will help you get Castle solving working in your setup - free advice on handling it programmatically, even as the challenge changes over time.
Switch to a different captcha type we support.