What's the difference between the standalone widget and a Challenge page?

A standalone widget just needs the site key - Turnstile renders inline on an otherwise normal page. A Cloudflare Challenge page ("Just a moment...") additionally passes action, cData, and chlPageData into turnstile.render(), and all three need to be captured and sent to us for that case.

Where do I submit the returned token?

Set solution.token as the value of the cf-turnstile-response hidden input field before submitting the form, or call the page's turnstile.render() callback function with the token if the site processes it via JavaScript instead of a form field.

Why do I need to reuse the returned user-agent?

The token is generated against a specific browser fingerprint during solving. Sending a different user-agent on your actual request than the one in data.useragent can cause Cloudflare to reject an otherwise valid token.

How long is a Turnstile token valid?

Cloudflare accepts a Turnstile token for 300 seconds and only once, so solve right before you submit the protected form or request instead of keeping tokens in a pool.

Turnstile 解决方案 API - 自动绕过 Turnstile

工作原理

Cloudflare Turnstile 解决方案的工作原理

Cloudflare's non-interactive challenge widget, used both as a standalone captcha embedded on a page and on full Cloudflare Challenge ("Just a moment...") interstitial pages. We solve both cases and return a token ready to submit.

即使 Cloudflare Turnstile 更新其防护机制，这个可预测的三步流程也始终保持不变。

For a standalone widget, send the site key and page URL. For a Cloudflare Challenge page, also send the action, cData, and chlPageData values captured from the page's turnstile.render() call.

01

提交目标

在一次 API 请求中发送页面 URL 和挑战特定字段。

02

我们处理挑战

CaptchaSolv 将任务路由到专门的解决方案，并跟踪直至完成。

03

使用解决方案

获取下一次请求所需的令牌、请求头、cookies 或 sensor payload。

Cloudflare Turnstile API 请求与响应

所有支持的解决方案使用相同的接口和响应格式。

POST /solve

请求

{
  "api_key": "YOUR_API_KEY",
  "type": "Turnstile",
  "site_url": "https://example.com/login",
  "data": {
    "site_key": "0x4AAAAAAAd3XXXXXXXXXX"}
}

响应200 OK

{
  "errorId": 0,
  "status": "ready",
  "solvtime": 3.1,
  "data": {
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "language": "en-US,en;q=0.9",
    "solution": {
      "token": "0.zrSnRHO7h0HwSjSCU8oyzbjEtD8p..."}
  }
}

任务数据字段

此验证码类型的求解请求中，可在 data 对象内发送的字段。

site_key必填

Turnstile sitekey - found inside the data-sitekey attribute of the turnstile div, or the sitekey argument of turnstile.render().

action可选

Required only for Cloudflare Challenge pages - the action value passed to turnstile.render().

cdata可选

Required only for Cloudflare Challenge pages - the cData value passed to turnstile.render().

pagedata可选

Required only for Cloudflare Challenge pages - the chlPageData value passed to turnstile.render().

解决方案字段

任务解决后在 data.solution 中返回的字段。

solution.token必填

Submit as the value of the cf-turnstile-response (or g-recaptcha-response, for reCAPTCHA-compatibility mode) hidden input, or pass it to the page's callback function.

data.useragent必填

The user-agent used while solving - reuse it on your request, the token is bound to this fingerprint.

What is Cloudflare Turnstile?

Cloudflare Turnstile is Cloudflare's CAPTCHA replacement. Instead of image puzzles, the widget runs a series of small non-interactive browser challenges - proof-of-work, proof-of-space, probes for web APIs and checks for browser quirks and human behaviour - and decides in the background whether the visitor is human.

Turnstile shows up in two places: as a standalone widget embedded in login, signup and checkout forms, and on full-page Cloudflare Challenge interstitials ("Just a moment..." / "Verify you are human"). Either way, a passed challenge produces a token that the page submits as cf-turnstile-response and the site validates with Cloudflare's siteverify API. Tokens are single-use and expire after 300 seconds.

Our Turnstile solver handles both cases. For a widget, send the site key and page URL; for a challenge page, add the action, cData and chlPageData values from turnstile.render(). You get back a token and the user-agent to send it with.

01
Widget renders
challenges.cloudflare.com loads the widget for the site's site key.
02
Silent checks
Non-interactive challenges probe the browser - most visitors never click anything.
03
Token issued
A cf-turnstile-response token is written into the form or passed to a callback.
04
Siteverify
The site's backend validates the token with Cloudflare once, within 300 seconds.

Turnstile parameters

sitekeyKey

Public key from data-sitekey or turnstile.render(), usually starting with 0x4.

cf-turnstile-responseKey

Hidden input the token is submitted in (g-recaptcha-response in compatibility mode).

action

Widget action - required for Cloudflare Challenge pages.

cData

Custom data passed to turnstile.render() on challenge pages.

chlPageData

Challenge-page payload from turnstile.render(), sent as pagedata.

user-agent

Reuse the user-agent from the solve - the token is bound to it.

分步指南

How to bypass Cloudflare Turnstile with the API

Turnstile never shows a puzzle, so there is nothing to click through. What you need is a valid cf-turnstile-response token for the exact site key and page.

01
Get the site key
Read data-sitekey from the cf-turnstile div, or the sitekey passed to turnstile.render().
02
Challenge page? Capture its data
On "Just a moment..." pages also capture action, cData and chlPageData from the turnstile.render() call.
03
Create a Turnstile task
POST site_url, site_key and the challenge fields (if any) to /solve and poll until the status is ready.
04
Submit the token
Put solution.token into cf-turnstile-response or pass it to the callback, and send the request with the returned user-agent within 300 seconds.

Cloudflare Turnstile 解决方案常见问题

关于正确集成此解决方案的常见问题。

Yes - it works on any site running Cloudflare Turnstile, whether it's embedded as a standalone widget on a normal page or shown on a full Cloudflare Challenge interstitial, not just a fixed list of targets.