Handling Cloudflare Turnstile in AI Browser Agents

Description and use

Headless browser agents stall on Cloudflare Turnstile because they cannot obtain a valid token. The fix is to request a token from Peak’s API, inject it into the page, trigger the callback, and resume the workflow.

Problem

AI browser agents stall when encountering Cloudflare Turnstile because the widget requires a valid token that headless browsers on cloud IPs cannot obtain.

Outcome

Agents can bypass Turnstile without complex fingerprinting by programmatically obtaining and injecting a valid token, reducing maintenance and token costs.

Workflow

• 1. Extract the Turnstile sitekey from the page’s data-sitekey attribute.
• 2. POST to https://api.peak.fo/solve with task_type "turnstiletaskproxyless", the page URL, and the sitekey to receive a token.
• 3. Inject the returned token into all cf-turnstile-response fields and invoke the widget’s callback (from data-callback or window.turnstile).

Evidence

Turnstile writes a value into a hidden input named cf-turnstile-response and fires a JavaScript callback once it's satisfied.

Source

One POST to https://api.peak.fo/solve with your API key in the header.

Source

Writing the token into the hidden input isn’t always enough on its own. Plenty of integrations wait for Turnstile’s callback before they enable the submit button or kick off the request.

Source