Handling Cloudflare Turnstile in AI Browser Agents

说明与用途

在 headless 浏览器代理中，Cloudflare Turnstile 需要一个有效令牌，代理无法获取。解决方案是通过 Peak API 请求令牌，注入页面并触发回调，然后继续执行。

问题

AI browser agents stall when encountering Cloudflare Turnstile because the widget requires a valid token that headless browsers on cloud IPs cannot obtain.

结果

Agents can bypass Turnstile without complex fingerprinting by programmatically obtaining and injecting a valid token, reducing maintenance and token costs.

工作流

• 1. Extract the Turnstile sitekey from the page’s data-sitekey attribute.
• 2. POST to https://api.peak.fo/solve with task_type "turnstiletaskproxyless", the page URL, and the sitekey to receive a token.
• 3. Inject the returned token into all cf-turnstile-response fields and invoke the widget’s callback (from data-callback or window.turnstile).

证据

Turnstile writes a value into a hidden input named cf-turnstile-response and fires a JavaScript callback once it's satisfied.

来源

One POST to https://api.peak.fo/solve with your API key in the header.

来源

Writing the token into the hidden input isn’t always enough on its own. Plenty of integrations wait for Turnstile’s callback before they enable the submit button or kick off the request.

来源