cloudflare-turnstile-bypass README

The project's README from github.com/henryzawadzki6542/cloudflare-turnstile-bypass. As one markdown file: README.md.

Peak - solve Cloudflare Turnstile & the 5s challenge in ~1s

Cloudflare Turnstile Bypass - How to Bypass the Turnstile Challenge in Python

Cloudflare Turnstile Bypass is a small, dependency-free Python package that bypasses the Cloudflare Turnstile challenge programmatically: it finds the Turnstile sitekey on any page, creates a valid cf-turnstile-response token via the Peak API, and hands you the finished token - no browser, no headless Chrome, no fingerprint fight. Designed for CI pipelines, QA automation, and integration engineering.

Table of Contents:

What "bypassing Turnstile" actually means

Cloudflare Turnstile is a challenge widget that issues a signed token. A "bypass" never attacks Cloudflare's edge - that is not practical or legal. What works, and what this package does, is:

  1. find the sitekey the target page is protecting itself with,
  2. solve the challenge for that sitekey through a solving service, and
  3. inject the resulting token into your request exactly like a browser would after completing the widget.

To Cloudflare's backend your request now carries a valid, signed, non-expired cf-turnstile-response - which is the entire contract the widget enforces. That is the bypass.

Quick start

$ export PEAK_API_KEY=pk_your_api_key
$ python -m cloudflare_turnstile_bypass --url https://example.com/
0.AgAAABBqzz...

Or find the sitekey first, then bypass:

from cloudflare_turnstile_bypass import find_sitekey, bypass_turnstile

sitekey = find_sitekey("https://example.com/")
token = bypass_turnstile("pk_...", sitekey, "https://example.com/")
print(token)  # -> "0.AgAAABBqzz..."

Finding a Turnstile sitekey

Turnstile widgets expose the sitekey in the markup:

<div class="cf-turnstile" data-sitekey="0x4AAAAAAAxxxx"></div>

find_sitekey() reads it for you:

from cloudflare_turnstile_bypass import find_sitekey

sitekey = find_sitekey("https://example.com/")
print(sitekey)  # -> "0x4AAAAAAAxxxx"

Invisible (enterprise) widgets render the same attribute; if a page builds the widget from JavaScript instead, the regex also matches sitekey= and render= in the bundle source.

Bypassing the challenge

from cloudflare_turnstile_bypass import bypass_turnstile

token = bypass_turnstile(
    "pk_your_api_key",          # your Peak key (free, no card)
    "0x4AAAAAAAxxxx",           # the sitekey you found
    "https://example.com/",     # the page URL the widget lives on
)
# token is a valid cf-turnstile-response value

With a proxy (the solve runs on residential infrastructure, so the token matches your exit IP region):

token = bypass_turnstile(
    "pk_your_api_key",
    "0x4AAAAAAAxxxx",
    "https://example.com/",
    proxy="http://user:pass@proxy:8080",
)

Python API reference

Function Purpose
read_page(url) Fetch a page's HTML (plain urllib, no dependencies).
find_sitekey(url) Extract the Turnstile sitekey from a page or HTML string.
find_action(html) Extract an optional data-action value.
bypass_turnstile(api_key, sitekey, url) Solve the challenge and return a ready token.
token_for_page(api_key, url) Find + bypass in a single call, returns BypassResult.

BypassResult carries .token, .sitekey, and the raw solver response.

CLI usage

$ python -m cloudflare_turnstile_bypass --url https://example.com/login
0.AgAAABBqzz...

$ python -m cloudflare_turnstile_bypass --url https://example.com/login --proxy http://user:pass@proxy:8080

Exit code 0 + the token on stdout - pipe it straight into curl or your E2E test harness.

Examples

See examples/submit_bypass.py for an end-to-end flow: find the sitekey, bypass the challenge, and POST the token with your form payload.

Why a solver beats headless browsers

This package uses Peak to solve Turnstile.

  • Solve Cloudflare Turnstile & the 5s challenge in about a second
  • Pay only for successful solves - from $0.8 / 1,000
  • 1,000 free solves to start - no card. Grab 1,000 free solves

Get your free API key · Docs · Pricing

License

MIT - see LICENSE.

cloudflare-turnstile-bypass (henryzawadzki6542/cloudflare-turnstile-bypass)

Searching Database…

614 ·GitHub
Cloudflare-turnstile-bypass
这是什么？一个零依赖的 Python 库和 CLI，能在页面上找到 Cloudflare Turnstile 的 sitekey，并通过第三方 API 解算挑战，交付一个有效的 cf-turnstile-response 令牌供你在自己的请求中使用。
这是一个独立的解题器还是付费服务的封装？它是一个轻薄的 Python 库（外加一个 CLI），只负责找到 sitekey 并组织请求；实际的解题由一个名为 Peak 的付费第三方服务完成，而不是这个包本身。
我该怎么用它获取令牌？先调用 findsitekey(url) 提取 sitekey，再调用 bypassturnstile(apikey, sitekey, url) 解算，或者用 tokenforpage(apikey, url) 一步完成；CLI 会把令牌直接输出到 stdout，方便通过管道传给 curl 或测试框架。
我需要 Peak API 密钥吗？是的，要真正解算挑战就需要 Peak API 密钥；Peak 提供 1000 次免费解题起步，无需绑卡，之后每 1000 次解题 0.8 美元起。
它会直接攻击 Cloudflare 的服务器吗？不会。项目明确声明它从不攻击 Cloudflare 的边缘节点；它只是定位 sitekey、让 Peak 解算那个特定挑战，然后像浏览器正常做法一样，把得到的签名令牌注入你的请求。
为什么不直接用 Selenium 或 Playwright 这类无头浏览器？Turnstile 会对浏览器环境进行指纹识别，无头 Chrome 和 CDP 自动化正是它要检测的对象。这个包完全跳过浏览器，CI 中无需匹配的 Chromium 版本，而且只在解题成功时才花钱，不会在失败的无头运行上浪费算力。
Peak 是什么？Peak 是这个库调用的外部解题服务，用来真正完成 Turnstile 挑战。它宣称借助住宅 IP 基础设施，大约一秒钟就能解出 Turnstile 和 5 秒挑战。
解题可以走代理吗？可以，bypassturnstile 接受代理参数，让解题在与你出口 IP 地区匹配的住宅基础设施上进行，使令牌的地理位置与你将要发送的请求保持一致。
它对隐形/企业版 Turnstile 组件有效吗？有效，findsitekey 也能处理隐形（企业版）组件，因为它们暴露同样的 sitekey 属性；如果组件是动态构建的，它还会回退到在页面的 JavaScript 包中用正则匹配 sitekey= 和 render=。
What are similar projects?cloudflare-turnstile-solver, nopecha-extension, captcha-api, botasaurus, undetected-chromedriver, turnstile-bypass, invisible_puppeteer, SeleniumBase
Which topics is it in?captcha-solving, qa, anti-bot, bot-detection, captcha, cloudflare, web-scraping, ci, http, security-tools, proxy, command-line-tool
Creator
henryzawadzki6542
Size
0.5 MB
Stars
614
Updated
CommitOct 12
Age
1mo
Commits · 90 Days