Cloudflare challenge page

The Cloudflare challenge page replaces a whole site with “Just a moment…” / “Checking your browser” before letting you in. YesCaptcha opens the page through the proxy you provide, passes the check, and returns the cookies (such as cf_clearance) and the User-Agent it used. CloudFlareTaskS3 costs 20 points (¥0.02) per task and is asynchronous. Failed and timed-out tasks are refunded automatically.

Not recommended

Cloudflare updates its checks frequently, and some sites may not pass or may not return cf_clearance. Test with a small batch first, and contact support if you run into problems.

POSThttps://api.yescaptcha.com/createTaskGlobal endpointCopy

POSThttps://cn.yescaptcha.com/createTaskChina endpointCopy

When to use

• The page source contains __cf_chl_rt_tk or cdn-cgi/challenge-platform, and the title is Just a moment...: this is the challenge page.
• If only a Cloudflare widget is embedded in a form, it is Turnstile instead.
• If your HTTP library gets a 403 with “Just a moment…” but a browser opens the page directly, you are probably only being blocked by TLS fingerprinting. A library that imitates a browser’s TLS fingerprint (such as curl_cffi) usually fixes it without solving anything.

Task types and pricing

Task type	Price	Mode	Notes
CloudFlareTaskS2	25 points (¥0.025)	Asynchronous	Not recommendedOwn proxy
CloudFlareTaskS3	20 points (¥0.02)	Asynchronous	Not recommendedOwn proxy

Request parameters

Field	Type	Required	Description
type	string	Yes	Task type; see "Task types and pricing" on this page
websiteURL	string	Yes	Full URL of the page that shows the captcha. Use the site you see the captcha on, not the captcha vendor's domain
proxy	string	Yes	Proxy as one string, e.g. http://user:[email protected]:8080 or socks5://proxy.example.com:1080. SOCKS5 with a password is not supported; local or private addresses will not work
waitLoad	boolean	No	Wait until the page has fully loaded before returning. Set to true if you need the full page content; it takes longer
requiredCookies	array	No	Cookie names you want returned, default ["cf_clearance"]. You can list several, but they are not guaranteed
blockImage	boolean	No	Skip loading images to save proxy traffic
postData	object	No	If set, the target URL is opened with a POST request carrying this object, e.g. {"name": "hi"}

Proxy

proxy is required. Cloudflare is strict about proxies, so use a good-quality proxy outside mainland China; on ERROR_CAPTCHA_UNSOLVABLE, change the proxy and try again. Local or private addresses (127.0.0.1, 192.168.x.x) won’t work because our servers cannot reach them, and SOCKS5 proxies with a password are not supported.

Don’t send a custom User-Agent; use the user_agent the API returns for later requests.

Request example

POST https://api.yescaptcha.com/createTask

{
  "clientKey": "YOUR_CLIENT_KEY",
  "task": {
    "type": "CloudFlareTaskS3",
    "websiteURL": "https://example.com/",
    "proxy": "http://user:[email protected]:8080",
    "waitLoad": false,
    "requiredCookies": [
      "cf_clearance"
    ]
  }
}

Then call getTaskResult every 5 seconds as for any asynchronous task; see getTaskResult.

Result

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": { "cf_clearance": "zqKrlel6E6_SM2707VdArsu2c5.bYqLKU3DOl4tlkCE-1691687641-0-1-8d7f630c..." },
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
    "request_headers": { "accept-language": "en-US,en;q=0.9", "user-agent": "Mozilla/5.0 ..." },
    "headers": { "server": "cloudflare" },
    "content": "<!DOCTYPE html>..."
  }
}

Field	Type	Description
cookies	object	Cookies obtained after passing the check, usually including cf_clearance. Use them together with the returned user_agent and the proxy you supplied
user_agent	string	The User-Agent used to pass the check; use it for all follow-up requests
request_headers	object	Request headers sent when passing the check; reuse them in follow-up requests
headers	object	Response headers from the target site
content	string	HTML source of the target page

Using the result

1. Make later requests with the returned cookies, the returned user_agent and the same proxy you used for the task. Cloudflare expects all three to match.
2. Send the request_headers too where possible, and use a browser-like TLS fingerprint (for example curl_cffi’s impersonate option).
3. cf_clearance stays valid for a while (up to an hour on some sites), so you don’t need to solve again within that time, but sending requests too fast may get the IP blocked by Cloudflare.