Why do I need to reuse the returned user-agent?

Castle's request token encodes device and behavioral signals tied to the browser fingerprint used to generate it, including the user-agent. Sending a different user-agent on your actual request can lower the trust score even with a technically valid token.

Should I reuse the same cuid across multiple requests?

Reuse solution.cuid as the __cuid cookie when you want consecutive requests to look like the same returning device - this is closer to real traffic than generating a brand-new device id on every single request.

Does the event field matter if I leave it out?

You can omit it, but supplying the correct event name (matching what Castle's browser SDK sends for that action) gives the risk engine more accurate context and can improve pass rates versus leaving it generic.

返回所有解决方案

专属解决方案

Castle 解决方案 API

Q: Does your Castle solver work on any site protected by Castle?

Yes - it works on any site using Castle's device fingerprinting and risk API, not just a fixed list of targets. Send the publishable key from the page you're hitting and we generate a valid request token for that specific integration.

通过一个稳定的 REST API 解决并绕过 Castle。发送目标信息，数秒内即可获得可直接使用的解决方案，无需维护自定义绕过逻辑。

开始解决查看文档

任务类型Castle

平均速度< 4s

每千次价格0,4$ / 1k

工作原理

Castle 解决方案的工作原理

Castle's device fingerprinting and behavioral risk signal, sent as the X-Castle-Request-Token header on requests to login, signup, and other protected endpoints. We generate a valid request token and device id so your request passes Castle's Risk and Filter API checks.

即使 Castle 更新其防护机制，这个可预测的三步流程也始终保持不变。

Send the Castle publishable key from the page and, if relevant, the event name for the action you're protecting (e.g. $login.succeeded). We return the X-Castle-Request-Token header value and a __cuid device id to send along with your request.

提交目标

在一次 API 请求中发送页面 URL 和挑战特定字段。

我们处理挑战

CaptchaSolv 将任务路由到专门的解决方案，并跟踪直至完成。

使用解决方案

获取下一次请求所需的令牌、请求头、cookies 或 sensor payload。

Castle API 请求与响应

所有支持的解决方案使用相同的接口和响应格式。

POST /solve

请求

{
  "api_key": "YOUR_API_KEY",
  "type": "Castle",
  "site_url": "https://example.com/login",
  "data": {
    "pub_key": "pk_XXXXXXXXXXXXXXXXXXXXXXXX",
    "event": "$login.succeeded"}
}

响应200 OK

{
  "errorId": 0,
  "status": "ready",
  "solvtime": 1.94,
  "data": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "language": "en-US,en;q=0.9",
    "solution": {
      "request_token": "eyJkYXRhIjoiZXlKe...",
      "cuid": "d290f1ee-6c54-4b01-90e6-d701748f0851"}
  }
}

任务数据字段

此验证码类型的求解请求中，可在 data 对象内发送的字段。

pub_key必填

The Castle publishable key loaded by the page's Browser SDK, prefixed pk_.

event可选

The activity name being protected, e.g. $login.succeeded or $registration.succeeded. Improves signal accuracy when supplied.

解决方案字段

任务解决后在 data.solution 中返回的字段。

solution.request_token必填

Send as the X-Castle-Request-Token header on the protected request.

solution.cuid可选

Device id to send as the __cuid cookie, for continuity across requests from the same simulated device.

data.useragent必填

The user-agent used while generating the token - reuse it on the protected request.

What is Castle?

Castle (castle.io) is a fraud-prevention and bot-detection platform that protects logins, sign-ups, password resets and other account flows. Its browser SDK, Castle.js, is loaded with the site's publishable key, fingerprints the device, records behavioural signals and packs them into a short-lived request token.

The page sends that token to its own backend - typically in the X-Castle-Request-Token header - and the backend forwards it to Castle's Risk or Filter API together with the event, such as $login or $registration. Castle answers with allow, challenge or deny, so a missing or low-quality token gets the request blocked even when the credentials are correct.

Our Castle solver generates a valid request token and a __cuid device ID for the publishable key you send, so your automation can call Castle-protected endpoints the same way the official browser SDK would.

01
Castle.js loads
The browser SDK starts with the site's pk_ publishable key.
02
Device fingerprint
It collects device, browser and behaviour signals in the background.
03
Request token
The signals are packed into a short-lived X-Castle-Request-Token.
04
Risk decision
The backend sends the token to Castle and gets allow, challenge or deny.

Castle headers & fields

X-Castle-Request-TokenKey

Header carrying the request token on protected requests.

pk_...Key

Publishable key loaded by Castle.js - send it as pub_key.

__cuidKey

Device ID cookie - reuse it to look like the same returning device.

event

Activity being protected, e.g. $login or $registration.

user-agent

Must match the user-agent the token was generated with.

分步指南

How to bypass Castle with the API

Castle-protected endpoints reject requests that arrive without a fresh, believable X-Castle-Request-Token. The solver produces that token from the publishable key alone.

01
Find the publishable key
Search the page or its JavaScript bundle for the pk_ key passed to Castle.js.
02
Create a Castle task
POST site_url, pub_key and, ideally, the event you're about to perform (e.g. $login.succeeded) to /solve.
03
Attach token and device ID
Send solution.request_token as the X-Castle-Request-Token header and solution.cuid as the __cuid cookie.
04
Keep the fingerprint consistent
Use the returned user-agent and reuse the cuid for follow-up requests from the same simulated device.

Castle 解决方案常见问题

关于正确集成此解决方案的常见问题。

Yes - it works on any site using Castle's device fingerprinting and risk API, not just a fixed list of targets. Send the publishable key from the page you're hitting and we generate a valid request token for that specific integration.