AWS WAF

AWS WAF applies one of two actions: a silent Challenge (invisible proof-of-work) or a visible image-grid CAPTCHA. AntiAwsWafTask auto-detects which and solves both end-to-end, returning a ready aws-waf-token.

One task, both actions

AWS WAF marks a flagged request with the x-amzn-waf-action header: either challenge (a silent proof-of-work, no visible puzzle) or captcha (a "choose all the chairs" image grid). A Challenge token does not clear a CAPTCHA gate, so AntiAwsWafTask reads the action for you and routes to the right solver — you don't need to know which one a page is on. Both return the same aws-waf-token, plus a ready cookie array and the userAgent to replay with.

For most sites, just send the websiteURL (and a proxy on AntiAwsWafTask). The optional descriptor fields are only for SPA / hash-routed / session-bound pages where the challenge isn't in the first HTML response — capture window.gokuProps and the script URLs from your own session and pass them.

AWS WAF (Challenge + CAPTCHA)

proxy optional

One task type for both AWS WAF actions. We read the enforced action (x-amzn-waf-action) and solve it: the silent Challenge proof-of-work OR the visible image-grid CAPTCHA, end-to-end. Returns a ready aws-waf-token. Use the proxy variant with your own IP for fewer CAPTCHA rounds.

type (proxyless / proxy)

AntiAwsWafTaskProxyLessAntiAwsWafTask

Task parameters

websiteURL*The protected URL. For most sites this is all you need — we detect Challenge vs CAPTCHA and solve either.

awsActionOptional override: "captcha" or "challenge" to force a path and skip the auto-detect pre-flight.

userAgentOptional. Replay the token with the RETURNED userAgent — the token is bound to the browser fingerprint (and domain), not the IP.

awsChallengeJSchallenge.js <script src> URL. For SPA / session-bound pages where we can't see the interstitial from a server fetch. Alias: challengeScript.

awsApiJsThe jsapi.js SDK URL, when the site loads the SDK build. We resolve challenge.js from the same directory.

awsCaptchaJScaptcha.js URL (optional — derived from awsChallengeJS). Alias: captchaScript.

awsKey / awsIv / awsContextwindow.gokuProps.{key,iv,context}, captured together from the same page load. Lets us host the widget without fetching (SPA/session-bound). Aliases: websiteKey / iv / context.

awsWafCookieDomainListwindow.awsWafCookieDomainList (the token domain scope, e.g. ["example.com"]). Pass it for SPA sites so the token is scoped correctly.

awsProblemUrl / awsApiKey / awsExistingTokenAdvanced / compat: the /problem endpoint + its key, and a prior token for secondary verification.

Returns

token (aws-waf-token), a ready cookies[] array ({name,value,domain,path}), and the userAgent to replay with.

Drop-in for CapSolver params; CapMonster AmazonTask field names are accepted as aliases (websiteKey→awsKey, context→awsContext, iv→awsIv, challengeScript→awsChallengeJS, captchaScript→awsCaptchaJS).

AWS WAF Grid Classification

Classification-only: you drive the widget in your own browser and just want tile indices. Send the nine RENDERED tiles + the prompt, receive the matches. Solved inline by ML, no proxy. (Not needed if you use AntiAwsWafTask, which solves the grid end-to-end.)

type

AwsWafClassification

Task parameters

images*The nine grid tiles as base64 images, as the browser RENDERS them.

question*The prompt, in aws:grid:<object> form (e.g. aws:grid:chair).

Returns

the indexes of the matching tiles.

Send decoded tile images. Raw obfuscated tiles pulled straight from the widget will not classify.

Example

The common case — one URL, we detect and solve:

aws-waf-task.json

{
  "clientKey": "capzy_YOUR_KEY",
  "task": {
    "type": "AntiAwsWafTask",
    "websiteURL": "https://example.com/protected",
    "proxyType": "http",
    "proxyAddress": "1.2.3.4",
    "proxyPort": 8080,
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Replay with the returned userAgent

The aws-waf-token is bound to the browser fingerprint and the token domain (not the IP). Set it as the aws-waf-token cookie on the target domain and send requests with the userAgent we return — a mismatched UA is rejected.

Migrating from CapSolver or CapMonster

Point your existing payload at us. We accept CapSolver's fields (awsKey / awsIv / awsContext / awsChallengeJS / awsApiJs) and CapMonster's AmazonTask names as aliases: websiteKey → awsKey, context → awsContext, iv → awsIv, challengeScript → awsChallengeJS, captchaScript → awsCaptchaJS.

See Using proxies for the proxy fields, and Getting the result for the polling loop that returns solution.

DataDome

Bot managers