How to Solve Cloudflare Turnstile in 2026 (Dev Guide)

Turnstile is the CAPTCHA you rarely see. No traffic lights, no fire hydrants, usually just a checkbox that ticks itself. That invisibility is the point, and it's also what makes it awkward to get past in an automated script. Your request works in a real browser and returns a wall in your scraper.

This guide is the practical version. What Turnstile is checking, the two real ways to solve it, working code against a solving API, and honest numbers from a solve we actually ran. It's written for people doing legitimate automation: scraping public data, testing your own forms, monitoring, QA. If you're logging into accounts that aren't yours, this isn't for you, and it's against our terms anyway.

What Cloudflare Turnstile actually checks

Cloudflare Turnstile is a challenge that scores the browser environment instead of asking a human to solve a puzzle. It runs JavaScript to look at how the browser behaves, checks signals like the JS engine and rendering, weighs Cloudflare's own network reputation for your IP, and issues a token when it decides you're probably real. Your form or backend then verifies that token server-side.

The key word is token. Turnstile doesn't grade a picture. It hands the page a string, and the site accepts or rejects based on that string. So "solving" Turnstile means one thing: producing a valid token for the site's specific sitekey, from an environment and IP that Cloudflare doesn't score as a bot.

There are three flavors you'll meet in the wild, and they matter later: non-interactive (runs silently, most common), managed (Cloudflare decides whether to show a checkbox), and invisible (no widget at all). Same token mechanism, different odds of a visible prompt.

The two ways to solve it: headless browser vs solving API

You have two real options. Run a real browser yourself and let it generate the token, or hand the job to a solving API that returns one. Most guides pick a side and sell it. Here's the honest split, then the detail.

My rule of thumb: if you're solving a handful of Turnstiles a day and you're already driving a real browser for other reasons, keep it in-house. Once you're doing volume, or the token is the only thing you actually need, a solving API stops being a shortcut and starts being cheaper than the engineering time you'd burn keeping a stealth browser undetected.

That second half is the part people underestimate. Turnstile changes. A stealth setup that passed last month starts failing, and now you own a detection arms race you didn't want. Offloading that is most of the value.

Solving Turnstile with an API, step by step

Here's the whole flow with Peak. It's four moves: read the sitekey, send a request, read the token, submit it. The API is one endpoint.

1. Get the sitekey and page URL

Turnstile renders the sitekey in the page HTML. Look for the widget element and its data-sitekey attribute, or grep the source for 0x4AAAAAAA, which is how Turnstile keys start. You need two things: that sitekey and the exact URL of the page showing the widget (with the trailing slash).

# find the sitekey in the page
<div class="cf-turnstile" data-sitekey="0x4AAAAAAAxxxxxxxx"></div>

2. Send the solve request

POST to https://api.peak.fo/solve with your API key in the X-API-Key header and the turnstiletask task type. Pass a proxy; more on why below.

import requests

resp = requests.post(
    "https://api.peak.fo/solve",
    headers={"X-API-Key": "pk_your_api_key"},
    json={
        "task_type": "turnstiletask",
        "url": "https://target.com/",
        "sitekey": "0x4AAAAAAAxxxxxxxx",
        "proxy": "http://user:pass@ip:port",
    },
    timeout=60,
)

data = resp.json()
if data["success"]:
    token = data["data"]["token"]
    print(token)

Same call in Node:

const res = await fetch("https://api.peak.fo/solve", {
  method: "POST",
  headers: {
    "X-API-Key": "pk_your_api_key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    task_type: "turnstiletask",
    url: "https://target.com/",
    sitekey: "0x4AAAAAAAxxxxxxxx",
    proxy: "http://user:pass@ip:port",
  }),
});

const data = await res.json();
if (data.success) console.log(data.data.token);

The full request and response reference, with examples in Python, JavaScript, Go, and cURL, lives in the Peak API docs.

3. Read the response

A success looks like this. The token is the payload; the cost field tells you exactly what that solve was billed.

{
  "success": true,
  "data": {
    "token": "1.7NmMrPSPAfY-1IiAwIXTr_stPHOJW0ce_w9KPjP6L6t..."
  },
  "cost": 0.0009
}

A failed solve returns "success": false with an error, and it isn't billed. That billing detail changes how you write your retry logic: you can be aggressive about retries because misses are free, and you only pay when you actually get a usable token.

4. Submit the token

The token goes back to the target as the cf-turnstile-response field. In a plain form post, that's a hidden input. If you're driving a browser, set the value and submit:

document.querySelector('[name="cf-turnstile-response"]').value = token;
document.querySelector('form').submit();

Turnstile tokens are single-use and short-lived. Grab one and use it now; don't cache a pile of them for later.

A real run: cost and timing

Numbers, because every other guide skips them. We ran a live solve against a real Turnstile through a US residential proxy. The API returned a valid token, and the response carried "cost": 0.0009. Timing lands around a second for most widgets, roughly 1 to 1.5 seconds; a heavy managed challenge on a demanding site takes a little longer.

The pricing math is simple. Turnstile is $0.90 per 1,000 solves at list, so one solve is a tenth of a cent, and you pay it only because the solve landed. Set a generous timeout anyway, say 30 seconds, so a rare slow challenge doesn't error out, and size concurrency around one to two seconds per solve.

Managed, non-interactive, and invisible: what changes

The task type stays turnstiletask across all three. What changes is difficulty and timing. Non-interactive is the friendly case. Managed is where Cloudflare leans harder on your IP and environment, so a clean proxy matters more and solves run longer. Invisible has no widget, but the sitekey is still in the page and the flow is identical.

You don't need to detect the mode yourself. Send the sitekey and URL; the solver handles the variant. Where mode bites you is on retries and proxy quality, not on your request shape.

Proxies: why sticky and residential matter

Skip the proxy and you're asking Cloudflare to score a datacenter IP that a solving service shares with everyone else. That's a bad hand. Pass your own proxy and the solve happens from an IP you control and trust.

For Turnstile, a decent residential or mobile proxy raises your success rate on managed challenges, because IP reputation is part of the score. Datacenter proxies can work on soft widgets and fail on hard ones. If you're also clearing the Cloudflare 5-second challenge, use a sticky session proxy so the same IP carries the clearance cookie afterward. One rented residential IP costs more than the solve itself, which tells you where the real spend on Cloudflare work sits: the proxy, not the token.

When a headless browser is the better call

An API isn't always right, and I'll say so. Reach for a real browser when you need to do things on the page after the challenge: click through a multi-step flow, read content that renders only after interaction, keep a long stateful session. The token is a means to an end there, and you needed the browser regardless.

Also keep it in-house when volume is tiny and predictable. Ten solves a day doesn't justify a dependency. The API earns its place when the token is the whole job, when you want misses to be free, or when you're tired of your stealth setup breaking every time Cloudflare ships an update. That last one is the quiet reason most teams switch.

Is solving Turnstile allowed?

Solving a CAPTCHA to automate access to a site is a gray area that depends entirely on what you're accessing and why. Scraping public data, testing your own properties, monitoring, and QA are ordinary engineering tasks. Logging into other people's accounts, credential stuffing, or hammering a service you don't own are not, and Peak's terms prohibit that use. Check the target's terms of service and robots rules, respect rate limits, and stay on the right side of the line. The tool is neutral; the use is on you.

FAQ

Can Cloudflare Turnstile be bypassed?

Yes, in the sense that you can produce a valid token programmatically, either by running a real browser that passes the check or by calling a solving API that returns one. It's not "broken." You're generating the same token a legitimate browser would, from an environment Cloudflare doesn't flag.

What is cf-turnstile-response?

It's the form field that carries the Turnstile token back to the site. When the widget succeeds, it populates a hidden input named cf-turnstile-response, and the server validates that value. When you solve via an API, you set that field to the token you got back.

Do I need a proxy to solve Turnstile?

For anything beyond a trivial widget, yes. IP reputation is part of Turnstile's score, so a clean residential or mobile proxy meaningfully raises success on managed challenges. You pass the proxy in the same solve request.

How much does it cost?

With Peak, Turnstile is $0.90 per 1,000 solves at list price, dropping to $0.35 per 1,000 on volume, and you only pay for solves that succeed. See the pricing page for the package tiers.

Is it fast?

Most Turnstile widgets come back in about a second, roughly 1 to 1.5 seconds. Heavier managed challenges take a bit longer. Size concurrency around a second or two per solve and set a 30-second timeout for the occasional slow one.

Keep reading

• Cloudflare Turnstile vs reCAPTCHA vs hCaptcha — how the three compare, and which is easiest to automate.
• The cf_clearance cookie, explained — for the 5-second challenge, which returns a cookie rather than a token.

Ready to try it on your own targets? Grab a key and run the first solve free at peak.fo.