AWS WAF Captcha

Overview

AWS WAF (Web Application Firewall) uses JavaScript challenges to protect websites. Our API solves these challenges and returns the required cookie token.

Supported Task Types

Create Task

Endpoint: POST /createTask

Request Parameters

Response

{
  "errorId": 0,
  "taskId": "61138bb6-19fb-11ec-a9c8-0242ac110006"
}

Get Task Result

Endpoint: POST /getTaskResult

Request

{
  "clientKey": "YOUR_API_KEY",
  "taskId": "61138bb6-19fb-11ec-a9c8-0242ac110006"
}

Response (Ready)

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookie": "aws-waf-token=xxxxxxxx...",
    "token": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:...",
    "captchaVoucher": "eyJ...",
    "userAgent": "Mozilla/5.0 ..."
  }
}

captchaVoucher is returned only for the visual-CAPTCHA flow (Situation 4) — submit it to the Amazon CVF endpoint /aaut/verify/cvf/{jwt}. The PoW flow (challenge.js) returns just cookie + token.

Mobile App Token (AntiAwsWafMobileTask)

Some native mobile apps protect their API with the AWS WAF mobile SDK instead of the web JavaScript challenge. For these, the aws-waf-token is minted on-device by the app's genuine SDK (a PBKDF2 proof-of-work over device signals) — there is no challenge.js, no page parameters, and no proxy.

AntiAwsWafMobileTask returns a genuine, freshly-minted mobile aws-waf-token. Present it to the target API exactly as the app does — as a Cookie: aws-waf-token=<token> header.

Request

{
  "clientKey": "YOUR_API_KEY",
  "task": { "type": "AntiAwsWafMobileTask" }
}

Response (Ready)

{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "token": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:DAoA...:...",
    "cookie": "aws-waf-token=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:DAoA...:...",
    "userAgent": "gyg_app/... CFNetwork/... Darwin/...",
    "captchaMethod": "mobile_sdk_pow"
  }
}

Send the returned cookie (or build the header yourself as aws-waf-token=<token>) with your request to the protected mobile API endpoint.

Parameter Situations (web challenges)

AWS WAF can be configured in different ways. Choose the situation that matches your target website.

Situation 1: Automatic Detection

When to use: You only have the website URL and want us to handle everything automatically.

Simply provide the websiteURL. Our system will visit the page, look for window.gokuProps (containing key, iv, context) and detect any challenge.js or jsapi.js scripts automatically.

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/protected-page"
  }
}

Situation 2: Manual Parameters

When to use: You have extracted key, iv, context, and challenge.js URL manually.

Required parameters: awsKey, awsIv, awsContext, awsChallengeJS

How to find them:

1. Open DevTools (F12) → Network tab
2. Look for requests to *.token.awswaf.com
3. Find window.gokuProps in the HTML containing key, iv, context

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/protected-page",
    "awsKey": "AQIDAHjA1234567890abcdefghijklmnop...",
    "awsIv": "a1b2c3d4e5f6g7h8",
    "awsContext": "eyJ0eXBlIjoiQ0FQVENIQSIsImNhcHRjaGFTY3JpcH...",
    "awsChallengeJS": "https://b516434d791a.aa24f28d.eu-west-1.token.awswaf.com/b516434d791a/challenge.js"
  }
}

Situation 3-1: Challenge.js Only

When to use: You can find challenge.js on the page but not the manual parameters (key, iv, context).

This is the most common scenario. The challenge.js script handles the WAF challenge (PoW token generation) automatically.

How to find it:

1. Open DevTools → Network tab
2. Filter by challenge.js
3. Copy the full URL (format: https://{apiKey}.{accountId}.{region}.token.awswaf.com/{apiKey}/challenge.js)

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/protected-page",
    "awsChallengeJS": "https://b516434d791a.aa24f28d.eu-west-1.token.awswaf.com/b516434d791a/challenge.js"
  }
}

Situation 3-2: jsapi.js Only

When to use: You cannot find challenge.js on the page, but you can find jsapi.js. The challenge.js script is assembled from the code inside jsapi.js, so either URL works.

How to find it:

1. Open DevTools → Network tab
2. Filter by jsapi.js
3. Copy the full URL (format: https://{apiKey}.{accountId}.{region}.captcha.awswaf.com/{apiKey}/jsapi.js)

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/protected-page",
    "awsApiJs": "https://b516434d791a.aa24f28d.eu-west-1.captcha.awswaf.com/b516434d791a/jsapi.js"
  }
}

Situation 4: Problem URL (Visual CAPTCHA)

When to use: You have the problem endpoint URL containing CAPTCHA configuration. This is used for visual CAPTCHA challenges (e.g., grid image selection).

The problem URL contains information about the visual CAPTCHA type and required solutions.

How to find it:

1. Open DevTools → Network tab
2. Filter by problem
3. Look for URLs like: https://xxx.captcha.awswaf.com/xxx/problem?kind=visual&...

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/protected-page",
    "awsProblemUrl": "https://xxx.us-east-1.captcha.awswaf.com/xxx/problem?kind=visual&domain=example.com&problem=gridcaptcha-5-0.15-0&num_solutions_required=2"
  }
}

Situation 5: Token Refresh (Secondary Verification)

When to use: You need to upgrade an existing token for higher security operations (SignUp, checkout, etc.). The problem endpoint typically contains an api_key value that is constant per website.

Some protected actions require a "fresh" token even if you already have a valid one.

Required parameters: awsExistingToken + awsApiJs or awsChallengeJS (whichever is available on the page)

Optional: awsApiKey - the api_key value found in the problem endpoint URL

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/signup",
    "awsApiJs": "https://xxx.captcha.awswaf.com/xxx/jsapi.js",
    "awsApiKey": "your_api_key_value",
    "awsExistingToken": "aws-waf-token=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:..."
  }
}

Or with challenge.js:

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/signup",
    "awsChallengeJS": "https://xxx.token.awswaf.com/xxx/challenge.js",
    "awsExistingToken": "aws-waf-token=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:..."
  }
}

How to Find the Right Parameters

Step-by-step Guide

1. Open the target page in Chrome with DevTools (F12) → Network tab
2. Filter by awswaf to find requests to *.awswaf.com domains
3. Identify the script URLs:

4. Copy the full URL and use it in your task payload along with websiteURL

Which parameter should I use?

How to Identify AWS WAF

Signs that a website uses AWS WAF:

DevTools Quick Check:

Network tab → Filter: "awswaf" → Look for challenge.js or jsapi.js

Code Examples

import requests
import time

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.capbypass.pro"

def solve_aws_waf(website_url, challenge_js=None, api_js=None):
    # Build task
    task = {
        "type": "AntiAwsWafTaskProxyLess",
        "websiteURL": website_url
    }
    if challenge_js:
        task["awsChallengeJS"] = challenge_js
    if api_js:
        task["awsApiJs"] = api_js

    # Create task
    response = requests.post(f"{BASE_URL}/createTask", json={
        "clientKey": API_KEY,
        "task": task
    })
    task_id = response.json()["taskId"]

    # Poll for result
    while True:
        result = requests.post(f"{BASE_URL}/getTaskResult", json={
            "clientKey": API_KEY,
            "taskId": task_id
        }).json()

        if result["status"] == "ready":
            return result["solution"]["cookie"]

        if result.get("errorId"):
            raise Exception(result.get("errorDescription"))

        time.sleep(2)

# Usage - Situation 1 (auto-detect)
cookie = solve_aws_waf("https://example.com")

# Usage - Situation 3-1 (challenge.js)
cookie = solve_aws_waf(
    "https://example.com",
    challenge_js="https://xxx.token.awswaf.com/xxx/challenge.js"
)

# Usage - Situation 3-2 (jsapi.js)
cookie = solve_aws_waf(
    "https://example.com",
    api_js="https://xxx.captcha.awswaf.com/xxx/jsapi.js"
)

const API_KEY = 'YOUR_API_KEY';
const BASE_URL = 'https://api.capbypass.pro';

async function solveAwsWaf({ websiteURL, awsChallengeJS, awsApiJs }) {
  // Build task
  const task = {
    type: 'AntiAwsWafTaskProxyLess',
    websiteURL
  };
  if (awsChallengeJS) task.awsChallengeJS = awsChallengeJS;
  if (awsApiJs) task.awsApiJs = awsApiJs;

  // Create task
  const createRes = await fetch(`${BASE_URL}/createTask`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ clientKey: API_KEY, task })
  });
  const { taskId } = await createRes.json();

  // Poll for result
  while (true) {
    const resultRes = await fetch(`${BASE_URL}/getTaskResult`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ clientKey: API_KEY, taskId })
    });
    const result = await resultRes.json();

    if (result.status === 'ready') {
      return result.solution.cookie;
    }

    if (result.errorId) {
      throw new Error(result.errorDescription);
    }

    await new Promise(r => setTimeout(r, 2000));
  }
}

Typical Solve Time

Error Codes

Next Steps