Why do I need to reuse the returned user-agent?

Kasada's headers are cryptographically bound to the exact user-agent used while solving. If your requests send a different user-agent than the one in data.useragent, Kasada detects the mismatch and treats the request as automated, even with valid headers.

What's the difference between a full solve and cd_only?

A full solve generates every header from scratch (x-kpsdk-cd, ct, st, r, cr) and is priced as a standard Kasada task. cd_only skips that and only recomputes the proof-of-work x-kpsdk-cd tied to a x-kpsdk-ct you already hold, which is why it's billed at 1/10th the price. The cd_only response contains just x-kpsdk-cd - pair it with the same ct you sent in.

How long are the returned headers valid for?

Kasada's tokens are short-lived and tied to a specific session. Reuse them immediately on your next request rather than caching them for later - once the underlying ct expires, cd and the rest of the headers stop being accepted.

Do I need a proxy for Kasada tasks?

No - unlike some other anti-bot systems, Kasada's checks don't depend on the solving proxy matching the IP you use for your actual requests. As long as the returned headers and user-agent are reused correctly, the session stays valid regardless of which IP the solve was performed from.

What are the x-kpsdk-ct and x-kpsdk-cd headers?

x-kpsdk-ct is the session token Kasada issues after scoring the sensor telemetry, and x-kpsdk-cd is the proof-of-work value computed for that session. Protected endpoints expect both on every request - the Kasada solver returns them, plus x-kpsdk-st, x-kpsdk-r and x-kpsdk-cr, ready to send.

Kasada Solver API - Bypass Kasada (KPSDK)

How it works

How the Kasada solver works

Kasada BotManager's JavaScript challenge (PJS), which collects sensor data and bot-detection telemetry. We solve the challenge and return the x-kpsdk-cd, x-kpsdk-ct, x-kpsdk-st, x-kpsdk-r, and x-kpsdk-cr headers your requests need.

A predictable three-step flow that stays the same even when Kasada changes its protection.

Send the PJS script URL from the target's x-kpsdk-v header or <script> tag. Once you already hold a valid x-kpsdk-ct, switch to cd_only to refresh just the proof-of-work x-kpsdk-cd header at 1/10th the price of a full solve.

01

Submit the target

Send the page URL and the challenge-specific fields in a single API request.

02

We handle the challenge

CaptchaSolv routes the task to a specialized solver and tracks it until completion.

03

Use the solution

Receive the token, headers, cookies, or sensor payload required by your next request.

Kasada API request & response

The same endpoint and response envelope across every supported solver.

POST /solve

Request

{
  "api_key": "YOUR_API_KEY",
  "type": "Kasada",
  "site_url": "https://example.com/api/data",
  "data": {
    "pjs": "https://example.com/149e9513.../2d206a39.../p.js"}
}

Response200 OK

{
  "errorId": 0,
  "status": "ready",
  "solvtime": 3.42,
  "data": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "language": "en-US,en;q=0.9",
    "solution": {
      "x-kpsdk-cd": "eyAgImlzQm90IjogZmFsc2U...",
      "x-kpsdk-ct": "0a5b8c3d...",
      "x-kpsdk-st": "1697234567890",
      "x-kpsdk-r": "eyJsYW5ndWFnZSI6ImVu...",
      "x-kpsdk-cr": "eyJob3N0bmFtZSI6..."}
  }
}

Task data fields

Fields you can send inside the data object of a solve request for this captcha type.

pjsRequired

The Kasada PJS (Primary JavaScript) URL or content, from the x-kpsdk-v header or a <script> tag. Not required when cd_only is used.

endpointOptional

The specific API endpoint URL to solve against. Defaults to site_url if omitted.

kasada_versionOptional

Override for the x-kpsdk-v version string, e.g. j-1.2.139. Auto-detected if omitted.

cd_onlyOptional

When true, only solves the x-kpsdk-cd proof-of-work header. Requires x-kpsdk-ct. Billed at 1/10th the normal Kasada price.

x-kpsdk-ctOptional

Required when cd_only is true - the current x-kpsdk-ct value for your session; cd is cryptographically tied to it.

Solution fields

Fields returned in data.solution once the task is solved.

solution.x-kpsdk-cdRequired

Challenge data header - pass this in subsequent requests. In cd_only mode this is the only field returned, and its value is a JSON string to be sent verbatim.

solution.x-kpsdk-ctRequired

Client timestamp header. Not returned in cd_only mode - keep using the ct you sent in.

solution.x-kpsdk-stOptional

Session token header.

solution.x-kpsdk-rOptional

Response header.

solution.x-kpsdk-crOptional

Challenge response header.

data.useragentRequired

The user-agent used during solving - must match on your requests, Kasada binds headers to this fingerprint.

What is Kasada?

Kasada (also referred to as KPSDK) is an anti-bot system that protects websites and APIs from automated traffic. Instead of showing a visible puzzle, it ships a heavily obfuscated JavaScript sensor to the browser and decides in the background whether a request comes from a real user or a bot.

Under the hood the script decrypts a bytecode program and runs it inside its own JavaScript virtual machine. That VM fingerprints the browser and environment - user-agent, screen, WebGL, timezone, plugins and anti-tamper probes - then encrypts the telemetry and posts it to Kasada's collection endpoint (/tl). The server scores that data and hands back the tokens a legitimate client is expected to reuse.

Because those tokens are short-lived and bound to a specific session and browser fingerprint, your requests have to carry the correct Kasada headers and keep the same user-agent throughout. Our solver reproduces this flow and returns the headers ready to drop straight into your requests.

That is also why the usual do-it-yourself ways to bypass Kasada - headless browsers, stealth plugins or replaying headers copied from DevTools - stop working quickly: the script changes often, automated browsers get fingerprinted by the VM, and a captured x-kpsdk-ct / x-kpsdk-cd pair expires within minutes. A Kasada solver API moves that maintenance off your plate while you keep your own HTTP client.

01
Obfuscated sensor
Kasada serves a heavily obfuscated ips.js script instead of a visible challenge.
02
Virtual machine
It decrypts a bytecode program and runs it in its own JS VM to fingerprint the browser.
03
Encrypted telemetry
The collected signals are encrypted and posted to Kasada's /tl endpoint.
04
Session tokens
The server scores the data and returns the short-lived x-kpsdk headers to reuse.

Kasada headers

x-kpsdk-ctKey

Telemetry session token - ties a client to its scored /tl submission and is sent on protected requests.

x-kpsdk-cdKey

Proof-of-work / challenge-data header derived for the session. This is the main header your requests must present.

x-kpsdk-vKey

Kasada SDK version string (e.g. j-1.2.x) - tells the server which script build produced the tokens.

x-kpsdk-st

Session timestamp issued alongside the tokens.

x-kpsdk-r

Response token returned by the challenge flow.

x-kpsdk-cr

Challenge-response value used on some endpoints.

Step-by-step guide

How to bypass Kasada with the API

You don't need to run or deobfuscate Kasada's script. Hand the solver the script URL, then send the headers it returns with your own requests.

01
Find the PJS script
Open the protected page and copy the Kasada script URL from its <script> tag - a long hashed path ending in /p.js.
02
Create a Kasada task
POST site_url (or the protected endpoint) and pjs to /solve and poll until it's ready. The solver runs the challenge and returns every x-kpsdk-* header.
03
Send the headers
Attach x-kpsdk-ct, x-kpsdk-cd and the other returned headers to your request and use exactly the user-agent from data.useragent - Kasada binds the tokens to it.
04
Refresh with cd_only
When the endpoint needs a new proof-of-work, send cd_only with your current x-kpsdk-ct to get a fresh x-kpsdk-cd at 1/10th of the full price.

Kasada solver FAQ

Common questions about integrating this solver correctly.

Yes - our Kasada solver works on any site protected by Kasada, not just a fixed list of targets. Send the PJS script from the page you're hitting and we solve that specific site's challenge, so new domains work the same way as the ones we already support.

Need help?

Stuck trying to bypass Kasada?

Join our Discord and our team will help you get Kasada solving working in your setup - free advice on handling it programmatically, even as the challenge changes over time.

Join our Discord