Captcha solving API: build tasks and fix rejects

A captcha solving API takes a challenge you describe, solves it, and returns a result: a token for widget captchas, text for image captchas. You create a task, read the result, and submit it with the request the captcha was blocking. With Wayfern, you send anti-captcha-style tasks to POST https://api.wayfern.com/api/captcha/solve using a captcha-scoped wf_ token, as the Wayfern API reference documents.

A Playwright price monitor, a QA run or a public-data job can load a page, scroll to the data, and then stop on a challenge widget. A captcha solving API is the fallback for that moment, once avoiding the challenge has failed.

After reading, you can build a task from the captcha type, site key and page URL, submit the returned token, and diagnose a rejected one. The steps assume testing, monitoring or public-data collection that stays within the site’s terms and the law.

Key Takeaways

• Tokens expire fast and work once, so submit from the same browser and exit that loaded the page.
• Avoid the challenge before paying to solve it: keep one browser identity and one stable exit.
• Wayfern publishes no solve-time or success-rate numbers, so test on your own targets.
• Wayfern’s pricing bills 1 credit per successful solve; the limits page caps captcha calls at 20 per minute.

How does a captcha solving API work?

A captcha solving API takes a captcha’s type, site key and page URL as a task, solves the challenge on the provider’s side, and returns a token or text. You submit that token to the target site with the request the captcha was blocking. Image-to-text captchas return text instead of a token.

The widget sets up the flow. In Google’s reCAPTCHA, the page carries a public site key. The widget hands the visitor a response token, the form posts it to the site’s server, and the server checks it with Google.

Google’s reCAPTCHA verification guide says it “explains how to verify a user’s response to a reCAPTCHA challenge from your application’s backend.”

hCaptcha’s developer docs describe the same site key and response token flow, with the token in h-captcha-response. Cloudflare introduced Turnstile as a “smart CAPTCHA alternative” that fits the same slot.

A solving API sits between those two steps. It produces the token, you place it where the widget would have, and you send the request.

The task format usually follows Anti-Captcha’s public reference, which documents createTask and getTaskResult. You create a task, then fetch its result. Anti-Captcha’s createTask reference shows the shape: a clientKey and a task object with a type and the fields that type needs.

Wayfern uses the same anti-captcha-style tasks. Check the Wayfern API reference for how the result comes back before you write your loop.

Which captcha types can a captcha solving API handle?

A captcha solving API handles the widget and image captchas listed below, and Wayfern’s limits page lists its task types: RecaptchaV2TaskProxyless, RecaptchaV2EnterpriseTaskProxyless, RecaptchaV3TaskProxyless, HCaptchaTaskProxyless, FunCaptchaTaskProxyless, GeeTestTaskProxyless, ImageToTextTask and TurnstileTaskProxyless.

Captcha type	What the task needs	What comes back	How the site validates it
reCAPTCHA v2	Site key, page URL	Token	Site’s server checks the token with Google
reCAPTCHA v2 Enterprise	Site key, page URL; other fields: see /docs/api	Token	Server-side check with Google
reCAPTCHA v3	Site key, page URL, action	Token	Server reads the score and action
hCaptcha	Site key, page URL	Token	Site’s server verifies the token with hCaptcha
Cloudflare Turnstile	Site key, page URL	Token	Server-side siteverify call
FunCaptcha	See /docs/api	See /docs/api	Site’s own server
GeeTest	See /docs/api	See /docs/api	Site’s own server
Image-to-text	The image; other fields: see /docs/api	Text	Site checks the text you enter in its form

We don’t guess at fields. Where the table says “see /docs/api”, the task fields and result schema for that type are published in the reference.

Google’s v3 documentation says “reCAPTCHA v3 returns a score for each request without user friction.”

The site chooses its own cutoff and can also compare the action name.

The validation column is the other half of the flow. Cloudflare documents Turnstile checks under “Server-side validation”, and hCaptcha’s developer docs cover “Verifying the User Response Server Side”.

Your solver only produces the token. The target site’s server decides whether to accept it.

Other solvers list more types. If your target uses a type outside the table, check each vendor’s own documentation and test against your real targets before you commit.

How do you find the site key and page URL a captcha solver needs?

You find the three inputs a solver needs (captcha type, site key and page URL) by reading the page that shows the challenge, before you build any task.

1. Identify the type. Open DevTools and look at the script sources and the widget element. Google’s reCAPTCHA display docs show the pattern: reCAPTCHA and hCaptcha render a div with data-sitekey, and Cloudflare Turnstile does the same. A picture of distorted text next to an input box is an image captcha.
2. Read the site key. The key is a public value in the widget configuration, so you can read it from the DOM. For a widget that a script renders, look for the key in the render call or in the request the widget makes.
3. Copy the exact page URL. Use the full address where the widget loads, not the site root.
4. Check v3 and Enterprise. For reCAPTCHA v3, read the action string passed to grecaptcha.execute in the page script. Enterprise has its own task type (RecaptchaV2EnterpriseTaskProxyless on the limits page), so don’t send an Enterprise key as plain v2.

const widget = page.locator("[data-sitekey]").first();
const siteKey = await widget.getAttribute("data-sitekey");
const pageUrl = page.url();

The task then carries those values: for reCAPTCHA v2, a type of RecaptchaV2TaskProxyless with the page URL and site key.

Wayfern’s captcha endpoint uses anti-captcha-style tasks too, and the field list in /docs/api shows what each type requires.

What comes back depends on the type. reCAPTCHA, hCaptcha and Turnstile return a token, and image captchas return text you type into the input.

Turnstile’s client-side rendering docs name the field your site reads, cf-turnstile-response. The other widgets use their own response fields.

Success at this step is a task the provider accepts without a parameter error. Run it on the same page URL you read the key from.

Should you solve the captcha at all, and is it allowed?

You should solve a captcha only after you’ve tried to avoid it and checked that your use is allowed. Both checks cost less than a failed run.

Avoid the challenge first. Sites tend to challenge sessions that look inconsistent. Keep one browser identity for the whole flow, hold one exit with a sticky session id, and don’t change IPs mid-page.

For page fetches, the Web Data API’s proxy: "auto" setting starts on a datacenter exit and retries on residential when blocked, as the API reference documents with the exact parameters. Failed Web Data requests are not billed.

Solve only if a challenge still appears after that. In a pipeline, the Web Data API fetches pages, the Search API returns results, and the MCP server serves AI agents. Captcha solving is the fallback step.

Check that solving is allowed. Before you send a task, confirm four things:

• Site terms: read what they say about automated access.
• Authorization: you own the site, have permission, or the data is public.
• Applicable law: rules differ by country and by the kind of data.
• Purpose: testing your own flows, monitoring, or public-data collection.

This is not legal advice. If any of the four is unclear, ask a lawyer before you automate.

Remember who captchas affect. The W3C Accessible Platform Architectures note “Inaccessibility of CAPTCHA” (December 2021) covers why captchas exist and why they shut out some users.

A solver doesn’t fix that for real visitors, so don’t treat a captcha on your own site as harmless.

How do you use a captcha solving API with Playwright?

You use a captcha solving API with Playwright by connecting to one browser session, reading the site key from the page that shows the challenge, posting a task to the solver, and writing the returned token into that same page before you submit.

1. Connect over CDP with a sticky exit. Playwright’s connectOverCDP() attaches to Wayfern’s hosted browser, and session=run42 holds one residential IP for the whole flow.
2. Load the page and read the site key. For reCAPTCHA v2 it sits in the data-sitekey attribute of the widget.
3. POST the task. Send it to https://api.wayfern.com/api/captcha/solve with a captcha-scoped wf_ token as the Bearer value. Wayfern’s captcha reference in /docs/api gives the exact body, the result shape and whether you must poll.
4. Write the token and submit. Put it in the response field, then submit from the same page.

import { chromium } from "playwright";
const browser = await chromium.connectOverCDP(
  "wss://api.wayfern.com/ws?token=LINK_TOKEN&country=US&session=run42",
);
const page = await browser.contexts()[0].newPage();
await page.goto("https://example.com/form");
const siteKey = await page.getAttribute(".g-recaptcha", "data-sitekey");
const res = await fetch("https://api.wayfern.com/api/captcha/solve", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WF_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ task: { type: "RecaptchaV2TaskProxyless",
    websiteURL: page.url(), websiteKey: siteKey } }),
});
const { solution } = await res.json();
await page.evaluate((t) => {
  document.querySelector("#g-recaptcha-response").value = t;
}, solution.gRecaptchaResponse);
await page.click("button[type=submit]");

The task fields follow the anti-captcha style. Confirm the result shape in the reference before you copy solution.gRecaptchaResponse.

Run the whole sequence within the token’s lifetime: Google says a reCAPTCHA token is valid for two minutes.

The solver runs on Wayfern’s side. Unless /docs/api documents a proxy field, don’t assume it solves from your sticky exit, and keep the submit inside the session that loaded the page.

That matters most for logged-in flows such as authenticated scraping.

For plain HTTP, make the same solve call, then send the token with the blocked request in the field the vendor documents:

• g-recaptcha-response for Google
• h-captcha-response for hCaptcha, per hCaptcha’s developer guide
• cf-turnstile-response for Cloudflare Turnstile, per Turnstile’s server-side validation docs

The browser and the solver draw on one credit balance.

The honest catch: Wayfern’s hosted browser is Chromium only, linux-x64. Try the solve call with a captcha-scoped token against your own target, because no solve-time or success-rate numbers are published.

Why does a solved captcha token get rejected?

A solved captcha token gets rejected for one of three reasons: it expired, it was already used, or the session that submits it doesn’t match the session that loaded the page. A fourth case looks like a rejection but isn’t: a reCAPTCHA v3 token can be valid and still carry a low score.

1. Expiry. A token is a short-lived receipt. Google’s reCAPTCHA documentation says “Each reCAPTCHA user response token is valid for two minutes, and can only be verified once to prevent replay attacks.” Request the token only when the form is ready, and submit it right away.
2. Single use. The target’s server checks the token with the vendor. For Cloudflare Turnstile, that means posting it to the siteverify endpoint, which returns timeout-or-duplicate for a token that has expired or was already validated. Retrying a failed request with the same token hits this error, so use one token per submission and solve again on failure.
3. Session mismatch. The solver returns a token, but the site judges the whole request that carries it. As Wayfern’s page on anti-detect browser sessions puts it, a cookie issued to one IP and replayed from another is an easy signal for a site to read.

A fingerprint that passes on page one is worth little if the exit changes by page four. Load the page, read the site key, write the token and submit from one browser.

With Wayfern, connect to the /ws URL with a residential exit and a fixed session id. The loading page and the submitting request then share one exit and one browser identity.

reCAPTCHA v3 is a separate failure mode. Google’s v3 documentation says it “returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot).”

A token can pass verification while the site still rejects the action, because the score falls under its threshold.

You can’t read that score from the browser, so check session consistency first. Then test against your own targets, because no published number tells you how a given site will score you.

What does a captcha solving API charge when a solve fails?

Wayfern’s captcha solving API charges 1 credit per successful solve and nothing when a solve fails, according to the per-call rates on the pricing page. A task that comes back with an error leaves your balance where it was.

The limits are just as plain:

• Rate: the captcha route accepts 20 requests per minute. The default API limit is 120 requests a minute per client IP, as listed on the limits page.
• Balance: credits hit a hard stop at zero. Calls are refused and open sessions are closed. Auto top-up is off by default, so you’re never billed beyond what you bought unless you turn it on.
• Trial: there’s no free tier; a credit pack or the Developer plan is the cheapest self-serve start.

Plan your concurrency around the 20 per minute ceiling. Create a task only when the page is ready to accept the token.

The honest catch: we don’t publish solve-time or success-rate numbers, and we won’t print invented ones. Run a batch of solves against your own targets and record the time, the outcome and the credits charged for each.

A dedicated solver may fit better in two cases. One is when you need more task types than Wayfern supports. The other is when you want a human-powered fallback for challenges automated solving misses.

For current prices and offers, go to each vendor’s pricing page. We don’t copy competitor figures because they change and we can’t date them.

Frequently asked questions

What is a captcha solving API?

A captcha solving API is an HTTP service that accepts a captcha task (type, site key, page URL) and returns the solution: a token for widget captchas or text for image captchas. Your code or browser then submits that result to the target site, which validates it server-side.

Is using a captcha solving API legal?

It depends on the site’s terms, whether you’re authorized to access the data, and the law where you operate. Check all three before you solve anything. This isn’t legal advice.

How fast and accurate is Wayfern captcha solving?

Wayfern publishes no solve-time or success-rate numbers, so test on your own targets. Treat any vendor’s speed or success figures as that vendor’s own claims.

Can I reuse a captcha token for more than one request?

Not safely. Google’s reCAPTCHA docs say each token is valid for two minutes and can be verified only once. Solve again for every request that needs a token.

When does a different captcha solver fit better?

Choose a dedicated solver when you need more task types than the list on our limits page. Choose a human-powered fallback when automated solves keep failing on one target.

What should you do next with a captcha solving API?

The next step with a captcha solving API is a single, legal, measured solve on one target before you build anything larger.

Today: Read the target site’s terms and confirm you’re authorized to collect the data. Then check whether a consistent browser identity and a stable exit avoid the challenge at all.

This week: On one target, identify the captcha type and site key. Make one solve call to the captcha solving API, then submit the token from the same session that loaded the page.

Before scaling: Log why tokens get rejected and what each target costs you in credits. Pace your solves to the captcha rate limit, and treat your own results as the only performance figures you have.

Pick the Developer plan or a credit pack on the pricing page. One balance covers the Browser API, Web Data API, Search API, captcha solving and MCP server, and a failed solve costs nothing.

Then follow the quickstart in the developer docs to create a captcha-scoped wf_ token and add credits.

Sources

CAPTCHA Solver API — Automated CAPTCHA Solving Service · API Reference - CDP, Web Data & Search | Wayfern · Verifying the user’s response | reCAPTCHA | Google for… · hCaptcha Developer Documentation · reCAPTCHA v3 | Google for Developers · Server-side validation | Cloudflare Turnstile docs · wayfern.com · Pricing - Credits for Browsers & the Web Data API | Wayfern. Every other source is linked where the article cites it.