Kasada 解决方案的工作原理
Kasada BotManager's JavaScript challenge (PJS), which collects sensor data and bot-detection telemetry. We solve the challenge and return the x-kpsdk-cd, x-kpsdk-ct, x-kpsdk-st, x-kpsdk-r, and x-kpsdk-cr headers your requests need.
即使 Kasada 更新其防护机制，这个可预测的三步流程也始终保持不变。
Send the PJS script URL from the target's x-kpsdk-v header or <script> tag. Once you already hold a valid x-kpsdk-ct, switch to cd_only to refresh just the proof-of-work x-kpsdk-cd header at 1/10th the price of a full solve.
提交目标
在一次 API 请求中发送页面 URL 和挑战特定字段。
我们处理挑战
CaptchaSolv 将任务路由到专门的解决方案，并跟踪直至完成。
使用解决方案
获取下一次请求所需的令牌、请求头、cookies 或 sensor payload。
Kasada API 请求与响应
所有支持的解决方案使用相同的接口和响应格式。
{
"api_key": "YOUR_API_KEY",
"type": "Kasada",
"site_url": "https://example.com/api/data",
"data": {
"pjs": "https://example.com/149e9513.../2d206a39.../p.js"}
}{
"errorId": 0,
"status": "ready",
"solvtime": 3.42,
"data": {
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
"language": "en-US,en;q=0.9",
"solution": {
"x-kpsdk-cd": "eyAgImlzQm90IjogZmFsc2U...",
"x-kpsdk-ct": "0a5b8c3d...",
"x-kpsdk-st": "1697234567890",
"x-kpsdk-r": "eyJsYW5ndWFnZSI6ImVu...",
"x-kpsdk-cr": "eyJob3N0bmFtZSI6..."}
}
}任务数据字段
此验证码类型的求解请求中，可在 data 对象内发送的字段。
pjs必填The Kasada PJS (Primary JavaScript) URL or content, from the x-kpsdk-v header or a <script> tag. Not required when cd_only is used.
endpoint可选The specific API endpoint URL to solve against. Defaults to site_url if omitted.
kasada_version可选Override for the x-kpsdk-v version string, e.g. j-1.2.139. Auto-detected if omitted.
cd_only可选When true, only solves the x-kpsdk-cd proof-of-work header. Requires x-kpsdk-ct. Billed at 1/10th the normal Kasada price.
x-kpsdk-ct可选Required when cd_only is true - the current x-kpsdk-ct value for your session; cd is cryptographically tied to it.
解决方案字段
任务解决后在 data.solution 中返回的字段。
solution.x-kpsdk-cd必填Challenge data header - pass this in subsequent requests. In cd_only mode this is the only field returned, and its value is a JSON string to be sent verbatim.
solution.x-kpsdk-ct必填Client timestamp header. Not returned in cd_only mode - keep using the ct you sent in.
solution.x-kpsdk-st可选Session token header.
solution.x-kpsdk-r可选Response header.
solution.x-kpsdk-cr可选Challenge response header.
data.useragent必填The user-agent used during solving - must match on your requests, Kasada binds headers to this fingerprint.
What is Kasada?
Kasada (also referred to as KPSDK) is an anti-bot system that protects websites and APIs from automated traffic. Instead of showing a visible puzzle, it ships a heavily obfuscated JavaScript sensor to the browser and decides in the background whether a request comes from a real user or a bot.
Under the hood the script decrypts a bytecode program and runs it inside its own JavaScript virtual machine. That VM fingerprints the browser and environment - user-agent, screen, WebGL, timezone, plugins and anti-tamper probes - then encrypts the telemetry and posts it to Kasada's collection endpoint (/tl). The server scores that data and hands back the tokens a legitimate client is expected to reuse.
Because those tokens are short-lived and bound to a specific session and browser fingerprint, your requests have to carry the correct Kasada headers and keep the same user-agent throughout. Our solver reproduces this flow and returns the headers ready to drop straight into your requests.
That is also why the usual do-it-yourself ways to bypass Kasada - headless browsers, stealth plugins or replaying headers copied from DevTools - stop working quickly: the script changes often, automated browsers get fingerprinted by the VM, and a captured x-kpsdk-ct / x-kpsdk-cd pair expires within minutes. A Kasada solver API moves that maintenance off your plate while you keep your own HTTP client.
- 01
Obfuscated sensor
Kasada serves a heavily obfuscated ips.js script instead of a visible challenge.
- 02
Virtual machine
It decrypts a bytecode program and runs it in its own JS VM to fingerprint the browser.
- 03
Encrypted telemetry
The collected signals are encrypted and posted to Kasada's /tl endpoint.
- 04
Session tokens
The server scores the data and returns the short-lived x-kpsdk headers to reuse.
Kasada headers
x-kpsdk-ctKeyTelemetry session token - ties a client to its scored /tl submission and is sent on protected requests.
x-kpsdk-cdKeyProof-of-work / challenge-data header derived for the session. This is the main header your requests must present.
x-kpsdk-vKeyKasada SDK version string (e.g. j-1.2.x) - tells the server which script build produced the tokens.
x-kpsdk-stSession timestamp issued alongside the tokens.
x-kpsdk-rResponse token returned by the challenge flow.
x-kpsdk-crChallenge-response value used on some endpoints.
How to bypass Kasada with the API
You don't need to run or deobfuscate Kasada's script. Hand the solver the script URL, then send the headers it returns with your own requests.
- 01
Find the PJS script
Open the protected page and copy the Kasada script URL from its <script> tag - a long hashed path ending in /p.js.
- 02
Create a Kasada task
POST site_url (or the protected endpoint) and pjs to /solve and poll until it's ready. The solver runs the challenge and returns every x-kpsdk-* header.
- 03
Send the headers
Attach x-kpsdk-ct, x-kpsdk-cd and the other returned headers to your request and use exactly the user-agent from data.useragent - Kasada binds the tokens to it.
- 04
Refresh with cd_only
When the endpoint needs a new proof-of-work, send cd_only with your current x-kpsdk-ct to get a fresh x-kpsdk-cd at 1/10th of the full price.
Kasada 解决方案常见问题
关于正确集成此解决方案的常见问题。
Yes - our Kasada solver works on any site protected by Kasada, not just a fixed list of targets. Send the PJS script from the page you're hitting and we solve that specific site's challenge, so new domains work the same way as the ones we already support.
Kasada's headers are cryptographically bound to the exact user-agent used while solving. If your requests send a different user-agent than the one in data.useragent, Kasada detects the mismatch and treats the request as automated, even with valid headers.
A full solve generates every header from scratch (x-kpsdk-cd, ct, st, r, cr) and is priced as a standard Kasada task. cd_only skips that and only recomputes the proof-of-work x-kpsdk-cd tied to a x-kpsdk-ct you already hold, which is why it's billed at 1/10th the price. The cd_only response contains just x-kpsdk-cd - pair it with the same ct you sent in.
Kasada's tokens are short-lived and tied to a specific session. Reuse them immediately on your next request rather than caching them for later - once the underlying ct expires, cd and the rest of the headers stop being accepted.
No - unlike some other anti-bot systems, Kasada's checks don't depend on the solving proxy matching the IP you use for your actual requests. As long as the returned headers and user-agent are reused correctly, the session stays valid regardless of which IP the solve was performed from.
x-kpsdk-ct is the session token Kasada issues after scoring the sensor telemetry, and x-kpsdk-cd is the proof-of-work value computed for that session. Protected endpoints expect both on every request - the Kasada solver returns them, plus x-kpsdk-st, x-kpsdk-r and x-kpsdk-cr, ready to send.
在绕过 Kasada 时遇到困难？
加入我们的 Discord，我们的团队会帮助您在您的环境中成功解决 Kasada - 提供免费建议，即使挑战随时间变化也能持续应对。