Solver Cloudflare

Integration Guide: Token & Cookie Usage

A comprehensive guide on how to integrate solved Tokens and Cookies (cf_clearance) returned by SolverCF into your automated workflows, scraping scripts, and backend requests.

1. Overview: Token vs. Cookie

Once your task status becomes ready, SolverCF returns the solved data within the solution object. Depending on your service and use case:

Result Type Corresponding Service Key Fields Primary Use Case
Token Turnstile, reCAPTCHA v3, Challenge (mode token) solution.token (or solution.gRecaptchaResponse) Form submissions (HTML hidden fields) or direct API payload authentication (Login, Register, Checkout, etc.)
Cookie Cloudflare Challenge (mode cookie), Turnstile (mode cookie) solution.cookie (cf_clearance), solution.userAgent Attached as HTTP headers to bypass Cloudflare 5s Shield / Turnstile WAF and fetch protected HTML or APIs directly

2. Using Solved Tokens (Turnstile & reCAPTCHA v3)

Captcha tokens (cf-turnstile-response and g-recaptcha-response) are short-lived verification strings (typically valid for 110 – 120 seconds). Submit the token to the target server immediately after receiving it.

Method 1: Direct API Submission (Headless / Without a Browser)

When the target website validates logins or form submissions via an AJAX/JSON endpoint, attach solution.token directly into the request payload:

Python (requests)

Python
import requests

token = "0.z8t..." # Token received from SolverCF getTaskResult
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36..."

headers = {
    "User-Agent": user_agent,
    "Content-Type": "application/json"
}

# Example: submitting a login form protected by Cloudflare Turnstile
payload = {
    "username": "[email protected]",
    "password": "SecretPassword123",
    "cf-turnstile-response": token # Or the parameter expected by the site (e.g., "turnstile_token")
}

response = requests.post("https://example.com/api/login", json=payload, headers=headers)
print("Status:", response.status_code)
print(response.json())

Node.js (axios)

JavaScript
const axios = require('axios');

async function submitWithToken(token, userAgent) {
    const payload = {
        username: "[email protected]",
        password: "SecretPassword123",
        "cf-turnstile-response": token
    };

    const response = await axios.post("https://example.com/api/login", payload, {
        headers: {
            "User-Agent": userAgent,
            "Content-Type": "application/json"
        }
    });

    console.log("Status:", response.status);
    console.log("Response:", response.data);
}

C# (HttpClient)

C#
using System.Net.Http.Json;

var token = "0.z8t..."; // Token from SolverCF
var userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...";

using var client = new HttpClient();
client.DefaultRequestHeaders.UserAgent.ParseAdd(userAgent);

var loginPayload = new
{
    username = "[email protected]",
    password = "SecretPassword123",
    cf_turnstile_response = token
};

var response = await client.PostAsJsonAsync("https://example.com/api/login", loginPayload);
var responseContent = await response.Content.ReadAsStringAsync();
Console.WriteLine(responseContent);

Method 2: DOM Injection in Browser Automation

If you are using an automated browser (Playwright, Puppeteer, Selenium), inject the token into the hidden input element and trigger the submit button or validation callback.

Playwright / Puppeteer (Node.js)

JavaScript
// 1. Inject the token into the hidden captcha input
await page.evaluate((token) => {
    // For Cloudflare Turnstile
    const turnstileInput = document.querySelector('[name="cf-turnstile-response"]');
    if (turnstileInput) {
        turnstileInput.value = token;
    }

    // For Google reCAPTCHA
    const recaptchaInput = document.querySelector('[name="g-recaptcha-response"]');
    if (recaptchaInput) {
        recaptchaInput.value = token;
    }

    // Trigger site callback if defined
    if (typeof window.onTurnstileSuccess === 'function') {
        window.onTurnstileSuccess(token);
    }
}, token);

// 2. Click the submit button
await page.click('button[type="submit"]');

Selenium (Python)

Python
# Inject the token into the DOM via execute_script
driver.execute_script("""
    var turnstileElem = document.querySelector('[name="cf-turnstile-response"]');
    if (turnstileElem) { turnstileElem.value = arguments[0]; }
    
    var recaptchaElem = document.querySelector('[name="g-recaptcha-response"]');
    if (recaptchaElem) { recaptchaElem.value = arguments[0]; }
""", token)

# Submit the form
submit_button = driver.find_element("css selector", 'button[type="submit"]')
submit_button.click()

3. Using Solved Cookies (cf_clearance)

When you solve a Cloudflare Challenge or Turnstile task with cloudflareTaskType: "cookie", SolverCF returns:

  • solution.cookie: The clearance cookie string (e.g., cf_clearance=v_a1b2c3d4...).
  • solution.userAgent: The exact User-Agent string used by the worker during the solve.

Caution

Golden Rules for Using cf_clearance: Cloudflare cryptographically binds the cf_clearance cookie to your device fingerprint and network IP:

  1. Match the User-Agent: You MUST send requests with the exact solution.userAgent returned by SolverCF.
  2. Match the IP / Proxy: You MUST route your subsequent requests through the identical IP/Proxy used when creating the task (task.proxy). If the IP or User-Agent differs, Cloudflare immediately rejects the cookie and throws an HTTP 403 Forbidden response.

Tip

Standard Python libraries like requests or urllib are frequently blocked by Cloudflare's TLS fingerprinting checks (JA3/JA4). We strongly recommend curl_cffi, which accurately impersonates Chrome's native TLS handshake and HTTP/2 settings.

Install curl_cffi:

cURL
pip install curl_cffi

Complete Example:

Python
from curl_cffi import requests

# Data received from SolverCF getTaskResult
clearance_cookie = "cf_clearance=s0M3ValuE..."
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
proxy = "http://username:password@proxy_host:proxy_port" # Must match the proxy sent in createTask

headers = {
    "User-Agent": user_agent,
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.9",
    "Cookie": clearance_cookie
}

proxies = {
    "http": proxy,
    "https": proxy
}

# Use impersonate="chrome124" to pass Cloudflare TLS fingerprint verification
response = requests.get(
    "https://protected-website.com/target-page",
    headers=headers,
    proxies=proxies,
    impersonate="chrome124"
)

print("Status Code:", response.status_code)
print("Page HTML Preview:", response.text[:500])

Node.js: Using got-scraping or axios

Install got-scraping (built-in TLS fingerprint and header spoofing):

cURL
npm install got-scraping

Example:

JavaScript
const { gotScraping } = require('got-scraping');

async function fetchProtectedPage() {
    const clearanceCookie = "cf_clearance=s0M3ValuE...";
    const userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...";
    const proxyUrl = "http://username:password@proxy_host:proxy_port";

    const response = await gotScraping({
        url: "https://protected-website.com/target-page",
        proxyUrl: proxyUrl,
        headers: {
            "User-Agent": userAgent,
            "Cookie": clearanceCookie
        },
        headerGeneratorOptions: {
            browsers: [{ name: 'chrome', minVersion: 120 }]
        }
    });

    console.log("Status:", response.statusCode);
    console.log("HTML Preview:", response.body.substring(0, 300));
}

fetchProtectedPage();

C#: Using HttpClient & CookieContainer

C#
using System.Net;

var clearanceRaw = "cf_clearance=s0M3ValuE...";
var clearanceValue = clearanceRaw.Replace("cf_clearance=", "").Trim();
var userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...";
var targetUri = new Uri("https://protected-website.com");

var cookieContainer = new CookieContainer();
cookieContainer.Add(targetUri, new Cookie("cf_clearance", clearanceValue)
{
    Domain = targetUri.Host,
    Path = "/"
});

var handler = new HttpClientHandler
{
    CookieContainer = cookieContainer,
    UseCookies = true,
    // When using a Proxy:
    // Proxy = new WebProxy("http://proxy_host:proxy_port") {
    //     Credentials = new NetworkCredential("user", "pass")
    // }
};

using var client = new HttpClient(handler);
client.DefaultRequestHeaders.UserAgent.ParseAdd(userAgent);
client.DefaultRequestHeaders.Add("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

var response = await client.GetAsync("https://protected-website.com/target-page");
Console.WriteLine($"Status: {response.StatusCode}");
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(content[..Math.Min(content.Length, 500)]);

Browser Automation: Injecting Cookies into Playwright & Selenium

If you want to control a real browser session after obtaining cf_clearance:

Playwright (Node.js)

JavaScript
const { chromium } = require('playwright');

(async () => {
    const browser = await chromium.launch({ headless: false });
    const context = await browser.newContext({
        userAgent: "Exact User-Agent from SolverCF"
    });

    // Add the clearance cookie into the context before navigation
    await context.addCookies([{
        name: 'cf_clearance',
        value: 's0M3ValuE...',
        domain: '.protected-website.com',
        path: '/'
    }]);

    const page = await context.newPage();
    await page.goto('https://protected-website.com/target-page');
})();

Selenium (Python)

Python
from selenium import webdriver

driver = webdriver.Chrome()

# Navigate to the target domain first to establish the cookie domain context
driver.get("https://protected-website.com/robots.txt")

driver.add_cookie({
    "name": "cf_clearance",
    "value": "s0M3ValuE...",
    "domain": ".protected-website.com",
    "path": "/"
})

# Navigate to the protected page
driver.get("https://protected-website.com/target-page")

4. Troubleshooting & Best Practices

Issue Likely Cause Solution
HTTP 403 Forbidden with cf_clearance Mismatched User-Agent or IP address. Ensure you send requests using the exact solution.userAgent and the same Proxy IP provided in createTask.
Blocked by TLS Fingerprint Using vanilla Python requests or tools that send obsolete TLS signatures. Switch to curl_cffi (Python) with impersonate="chrome124" or got-scraping (Node.js).
Token Expired or Invalid Exceeded the 110–120s TTL window. Submit tokens immediately upon receiving ready. For ultra-fast flows (< 100ms), use our Pre-solved Token Pool.
Site Key Mismatch Incorrect websiteKey or websiteUrl. Inspect the live page DOM for data-sitekey or turnstile.render(...) calls to verify the key.