High-Speed Stealth Scraping
Cloudflare Turnstile Auto-Bypass

The service includes a built-in Subdomain-Aware LRU In-Memory Cookie Store with Session Isolation & Pattern Allowlist Filtering. When a Cloudflare Turnstile challenge is solved, clearance tokens and sessions are stored automatically. Subsequent requests reuse these cookies to hit the fast-path (300ms) without opening a browser.

• Dual-Store Architecture (Zero LRU Pollution): Separates long-lived domain caches (64 slots, 24h TTL) from ephemeral scraping sessions (256 slots, 10m TTL). High-volume task session churn never evicts root domain clearances (such as example.com).
• Strict Session Isolation: When session_id is provided (e.g. "task-dl-1"), the request runs in an isolated sandbox. It never falls back to the root domain and never writes to root, preventing session cookie contamination and bot-score cross-linking via __cf_bm.
• Synchronized Root Clearance: Non-session domain clearances write strictly cf_clearance to the root domain, atomically synchronizing matching User-Agent and proxy identities. When a challenge wall is encountered, rejected clearance is immediately purged from both the local session and root storage.
• cookie_allowlist: Array of allowed cookie names or glob/regex wildcard patterns (e.g. ["cf_*", "__cf*", "*session*", "PHPSESSID"]). Non-essential tracking cookies and analytics are pruned automatically.
• cookie_limit: Upper bound on the number of cookies sent in request headers (default 35, 3.5 KB max) to prevent HTTP 400 header overflow.
• inject_cookies: Inject custom session cookies before navigation. Injected cookies always bypass allowlist filters and take precedence.
• cookie_ttl: Cache duration in seconds for domain-level entries (default 86400 = 24 hours). Ephemeral sessions default to 10 minutes (600s).

{
  "url": "https://new5.example.com/protected-page",
  "session_id": "task-dl-42",
  "cookie_allowlist": [
    "cf_*",
    "__cf*",
    "*session*",
    "PHPSESSID"
  ],
  "cookie_limit": 25
}

The system keeps a persistent Chromium process per egress identity (direct, or one per proxy), capped by MAX_BROWSERS. Incoming requests acquire a worker tab through a semaphore pool (MAX_TABS) and clean up their isolated browser context on completion. Idle processes are recycled after BROWSER_MAX_LIFETIME_SEC.

• force_browser: Set to true to skip the HTTP fast-path and drive Chrome directly. Use this for complex Single Page Apps (SPA) that require client-side JavaScript rendering.
• force_http: Set to true to stay on the HTTP engine only. The browser is never started; a 403 or challenge page is returned as-is. Use this for POST/API calls where a 403 comes from the site itself, not Cloudflare.
• cf_wait: Maximum duration in seconds to wait for Cloudflare Turnstile to solve and redirect (default 25.0s). Early-exits immediately as soon as the challenge is solved.
• Dynamic Redirect Cache: When an origin domain redirects to a separate domain post-challenge (e.g. .com → .net), the API caches the destination so subsequent requests hit the final URL directly on the fast-path.

{
  "url": "https://example.com/dynamic-spa",
  "force_browser": true,
  "cf_wait": 15.0
}

Fine-tune the wire-level network behavior, fingerprint profiles and User-Agent headers.

• user_agent: Pass a custom User-Agent string to override the preset's default. If omitted, the authentic preset User-Agent is sent.
• preset: Select from bundled browser fingerprint profiles: "chrome-latest-windows", "chrome-latest-linux", "firefox-latest".
• proxy: Route the request through an HTTP, HTTPS or SOCKS5 proxy. Each proxy gets its own browser process with matching timezone, locale and WebRTC IP.
• http_version: Force protocol version ("h1", "h2", "h3") or leave as null for auto-negotiation via ALPN.

{
  "url": "https://example.com/api/data",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
  "preset": "chrome-latest-windows",
  "http_version": "h2",
  "timeout": 45
}

Send any request through a residential, ISP or datacenter proxy. Cloudflare binds cf_clearance to the IP that earned it and checks that the browser's timezone, language and WebRTC address agree with that IP, so the API treats every proxy as a separate egress identity end to end.

Supported formats

Examples

{
  "url": "https://example.com/protected",
  "proxy": "http://user:pass@res.example.net:8000"
}

{
  "url": "https://example.com/download/42",
  "proxy": "socks5://user:pass@1.2.3.4:1080",
  "session_id": "task-dl-42",
  "force_browser": true
}

Failure handling

Copy-pasteable code examples across languages and runtimes for stealth scraping and standalone Turnstile solving.

import httpx

# Send stealth request with API key
response = httpx.post(
    "http://127.0.0.1:8000/fetch",
    headers={"X-API-Key": "anti_secret_key_123"},
    json={
        "url": "https://example.com/protected-page",
        "selector": "title",
        "cf_wait": 25.0
    },
    timeout=30.0
)

data = response.json()
print("Status Code:", data["status_code"])
print("Engine Used:", data["meta"]["via"])
print("Extracted:", data["extracted"])

import os, httpx

response = httpx.post(
    "http://127.0.0.1:8000/fetch",
    headers={"X-API-Key": os.environ.get("ANTI_API_KEY", "anti_secret_key_123")},
    json={
        "url": "https://example.com/download-portal",
        "proxy": "http://user:pass@residential.proxy:8080",
        "session_id": "task-dl-42",
        "click_selector": "button#start-download"
    },
    timeout=60.0
)
data = response.json()
print("Redirect chain:", data["redirect_chain"])

curl -X POST http://127.0.0.1:8000/fetch \
  -H "X-API-Key: anti_secret_key_123" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/protected-page",
    "preset": "chrome-latest-windows"
  }'

const res = await fetch('http://127.0.0.1:8000/fetch', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'anti_secret_key_123'
  },
  body: JSON.stringify({
    url: 'https://example.com/login',
    force_browser: true,
    cf_wait: 20
  })
});
const data = await res.json();
console.log(data.status_code, data.cookies);

curl -X POST http://127.0.0.1:8000/solve-turnstile \
  -H "X-API-Key: anti_secret_key_123" \
  -H "Content-Type: application/json" \
  -d '{
    "sitekey": "0x4AAAAAAADn3gM1k2p1n_dummy",
    "siteurl": "https://example.com/protected-form",
    "timeout": 30
  }'

# Response:
# {"solved": true, "token": "0.xxxx...", "elapsed": 3.42, "siteurl": "https://example.com/protected-form", "proxy": null}