What's the difference between the standalone widget and a Challenge page?

A standalone widget just needs the site key - Turnstile renders inline on an otherwise normal page. A Cloudflare Challenge page ("Just a moment...") additionally passes action, cData, and chlPageData into turnstile.render(), and all three need to be captured and sent to us for that case.

Where do I submit the returned token?

Set solution.token as the value of the cf-turnstile-response hidden input field before submitting the form, or call the page's turnstile.render() callback function with the token if the site processes it via JavaScript instead of a form field.

Why do I need to reuse the returned user-agent?

The token is generated against a specific browser fingerprint during solving. Sending a different user-agent on your actual request than the one in data.useragent can cause Cloudflare to reject an otherwise valid token.

How long is a Turnstile token valid?

Cloudflare accepts a Turnstile token for 300 seconds and only once, so solve right before you submit the protected form or request instead of keeping tokens in a pool.

Turnstile Solver API - Bypass Cloudflare Turnstile

How it works

How the Cloudflare Turnstile solver works

Cloudflare's non-interactive challenge widget, used both as a standalone captcha embedded on a page and on full Cloudflare Challenge ("Just a moment...") interstitial pages. We solve both cases and return a token ready to submit.

A predictable three-step flow that stays the same even when Cloudflare Turnstile changes its protection.

For a standalone widget, send the site key and page URL. For a Cloudflare Challenge page, also send the action, cData, and chlPageData values captured from the page's turnstile.render() call.

01

Submit the target

Send the page URL and the challenge-specific fields in a single API request.

02

We handle the challenge

CaptchaSolv routes the task to a specialized solver and tracks it until completion.

03

Use the solution

Receive the token, headers, cookies, or sensor payload required by your next request.

Cloudflare Turnstile API request & response

The same endpoint and response envelope across every supported solver.

POST /solve

Request

{
  "api_key": "YOUR_API_KEY",
  "type": "Turnstile",
  "site_url": "https://example.com/login",
  "data": {
    "site_key": "0x4AAAAAAAd3XXXXXXXXXX"}
}

Response200 OK

{
  "errorId": 0,
  "status": "ready",
  "solvtime": 3.1,
  "data": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "language": "en-US,en;q=0.9",
    "solution": {
      "token": "0.zrSnRHO7h0HwSjSCU8oyzbjEtD8p..."}
  }
}

Task data fields

Fields you can send inside the data object of a solve request for this captcha type.

site_keyRequired

Turnstile sitekey - found inside the data-sitekey attribute of the turnstile div, or the sitekey argument of turnstile.render().

actionOptional

Required only for Cloudflare Challenge pages - the action value passed to turnstile.render().

cdataOptional

Required only for Cloudflare Challenge pages - the cData value passed to turnstile.render().

pagedataOptional

Required only for Cloudflare Challenge pages - the chlPageData value passed to turnstile.render().

Solution fields

Fields returned in data.solution once the task is solved.

solution.tokenRequired

Submit as the value of the cf-turnstile-response (or g-recaptcha-response, for reCAPTCHA-compatibility mode) hidden input, or pass it to the page's callback function.

data.useragentRequired

The user-agent used while solving - reuse it on your request, the token is bound to this fingerprint.

What is Cloudflare Turnstile?

Cloudflare Turnstile is Cloudflare's CAPTCHA replacement. Instead of image puzzles, the widget runs a series of small non-interactive browser challenges - proof-of-work, proof-of-space, probes for web APIs and checks for browser quirks and human behaviour - and decides in the background whether the visitor is human.

Turnstile shows up in two places: as a standalone widget embedded in login, signup and checkout forms, and on full-page Cloudflare Challenge interstitials ("Just a moment..." / "Verify you are human"). Either way, a passed challenge produces a token that the page submits as cf-turnstile-response and the site validates with Cloudflare's siteverify API. Tokens are single-use and expire after 300 seconds.

Our Turnstile solver handles both cases. For a widget, send the site key and page URL; for a challenge page, add the action, cData and chlPageData values from turnstile.render(). You get back a token and the user-agent to send it with.

01
Widget renders
challenges.cloudflare.com loads the widget for the site's site key.
02
Silent checks
Non-interactive challenges probe the browser - most visitors never click anything.
03
Token issued
A cf-turnstile-response token is written into the form or passed to a callback.
04
Siteverify
The site's backend validates the token with Cloudflare once, within 300 seconds.

Turnstile parameters

sitekeyKey

Public key from data-sitekey or turnstile.render(), usually starting with 0x4.

cf-turnstile-responseKey

Hidden input the token is submitted in (g-recaptcha-response in compatibility mode).

action

Widget action - required for Cloudflare Challenge pages.

cData

Custom data passed to turnstile.render() on challenge pages.

chlPageData

Challenge-page payload from turnstile.render(), sent as pagedata.

user-agent

Reuse the user-agent from the solve - the token is bound to it.

Step-by-step guide

How to bypass Cloudflare Turnstile with the API

Turnstile never shows a puzzle, so there is nothing to click through. What you need is a valid cf-turnstile-response token for the exact site key and page.

01
Get the site key
Read data-sitekey from the cf-turnstile div, or the sitekey passed to turnstile.render().
02
Challenge page? Capture its data
On "Just a moment..." pages also capture action, cData and chlPageData from the turnstile.render() call.
03
Create a Turnstile task
POST site_url, site_key and the challenge fields (if any) to /solve and poll until the status is ready.
04
Submit the token
Put solution.token into cf-turnstile-response or pass it to the callback, and send the request with the returned user-agent within 300 seconds.

Cloudflare Turnstile solver FAQ

Common questions about integrating this solver correctly.

Yes - it works on any site running Cloudflare Turnstile, whether it's embedded as a standalone widget on a normal page or shown on a full Cloudflare Challenge interstitial, not just a fixed list of targets.

Need help?

Stuck trying to bypass Cloudflare Turnstile?

Join our Discord and our team will help you get Cloudflare Turnstile solving working in your setup - free advice on handling it programmatically, even as the challenge changes over time.

Join our Discord