Cloudflare Turnstile Solver

Cloudflare Turnstile is a CAPTCHA alternative from Cloudflare that verifies visitors through browser signals and risk assessment instead of image puzzles. It has three widget modes. Managed (recommended): Cloudflare chooses between a non-interactive check and a checkbox based on visitor risk. Non-interactive: a visible widget with a loading spinner that never requires interaction. Invisible: no widget at all. CapMonster Cloud handles all three automatically, so you do not specify the mode in the task.

No. TurnstileTask works without a proxy, and the proxy fields (proxyType, proxyAddress, proxyPort, proxyLogin, proxyPassword) are optional. A proxy that matches the geography of the target site can improve results on geo-sensitive pages, so it is worth testing both configurations. Transparent proxies and proxies on local machines are not allowed. Without your own proxy, CapMonster Cloud solves the task through its built-in proxies (IP address 65.21.190.34).

Open DevTools, find the element with the data-sitekey attribute (and data-action, if the page sets an action) and copy the values; a Turnstile site key looks like 0x4AAAAAAABUYP0XeMJF0xoy. Some values change every time the page loads, so extract them right before creating the task. Step-by-step instructions are in the section above.

cf-turnstile-response is the hidden form field that holds the Turnstile token. The token is valid for 300 seconds (5 minutes) and can be validated only once; after that Siteverify returns the timeout-or-duplicate error. Submit the token you received from CapMonster Cloud right away and request a new one for every submission.

To insert a Turnstile token, find the hidden response field (an input named cf-turnstile-response) and set it to the token retrieved from CapMonster Cloud. Here is how to do it across the three automation frameworks.

Playwright / Puppeteer (Node.js):

javascript

const token = "YOUR_TOKEN";
await page.evaluate((t) => {
  document.querySelector('[name="cf-turnstile-response"]').value = t;
}, token);
await page.click('#submit-btn');

Selenium (Python):

javascript

token = "YOUR_TOKEN"
driver.execute_script("document.querySelector('[name=\"cf-turnstile-response\"]').value = arguments[0];", token)
driver.find_element("id", "submit-btn").click()

If the form validates the token through a callback function (the data-callback attribute of the widget), call that function with the token instead.

Use Cloudflare's dummy keys. On the client, set the sitekey to 1x00000000000000000000AA (always passes), 2x00000000000000000000AB (always fails) or 3x00000000000000000000FF (forces an interactive challenge); on the server, use a dummy secret key such as 1x0000000000000000000000000000000AA. Dummy sitekeys work on any domain, including localhost, and produce the token XXXX.DUMMY.TOKEN.XXXX, which only dummy secret keys accept. The full list is in the test section above.

Siteverify returns success: false when the token is older than 300 seconds, has already been validated, or the secret key is wrong, and your server may also reject it if the returned hostname or action does not match what you expect. Check the error-codes array in the response and see the Siteverify error code table. Request a new token for every submission and send it right after you receive it.