Overview

Scrapingbypass API V2 features an automated token injection system. You do not need to manually solve the Turnstile challenge or extract the cf-turnstile-response token to perform actions like logging in or submitting forms.

Instead of a multi-step process (Get Token -> Extract Token -> Submit Token), the V2 engine handles the challenge execution and payload injection in a single seamless request.

Implementation Logic

To bypass Turnstile during a POST request (e.g., a login attempt), follow these steps:

1. Identify the Sitekey: Locate the data-sitekey or sitekey from the target website's HTML source.
2. Add the Sitekey Header: Include the X-Cb-Sitekey header in your request.
3. Use the Token Placeholder: Use the literal string [cf_token] in any field (Headers or JSON body) where the target server expects the Turnstile response token.

Configuration Example

When calling a protected endpoint, structure your request as follows:

• Headers:
  • X-Cb-Sitekey: YOUR_TARGET_SITEKEY
  • X-Turnstile-Response: [cf_token] (If required by headers)
• Request Body (JSON):
  • cf-turnstile-response: [cf_token]
• Parameters:
  • part="0" (Required for V2 logic)

Why Manual Retrieval is Not Supported

The Turnstile token is mathematically bound to the specific browser environment and session state. Because Scrapingbypass API manages the browser fingerprinting (JA3, HTTP/2) and JS execution internally, extracting the token to use in a different environment would cause a validation mismatch at the WAF level.

By using the [cf_token] placeholder, you instruct our backend to:

1. Initialize the Turnstile challenge environment.
2. Solve the challenge using the provided X-Cb-Sitekey.
3. Automatically replace the string [cf_token] with the freshly generated, valid response token before sending the final request to the target server.

Key Advantage

This "Placeholder" method ensures 100% synchronization between the browser fingerprint, cookies, and the Turnstile token, significantly increasing the success rate of automated logins.