cloudflare-turnstile-bypass README

The project's README from github.com/henryzawadzki6542/cloudflare-turnstile-bypass. As one markdown file: README.md.

Peak - solve Cloudflare Turnstile & the 5s challenge in ~1s

Cloudflare Turnstile Bypass - How to Bypass the Turnstile Challenge in Python

Cloudflare Turnstile Bypass is a small, dependency-free Python package that bypasses the Cloudflare Turnstile challenge programmatically: it finds the Turnstile sitekey on any page, creates a valid cf-turnstile-response token via the Peak API, and hands you the finished token - no browser, no headless Chrome, no fingerprint fight. Designed for CI pipelines, QA automation, and integration engineering.

Table of Contents:

What "bypassing Turnstile" actually means

Cloudflare Turnstile is a challenge widget that issues a signed token. A "bypass" never attacks Cloudflare's edge - that is not practical or legal. What works, and what this package does, is:

  1. find the sitekey the target page is protecting itself with,
  2. solve the challenge for that sitekey through a solving service, and
  3. inject the resulting token into your request exactly like a browser would after completing the widget.

To Cloudflare's backend your request now carries a valid, signed, non-expired cf-turnstile-response - which is the entire contract the widget enforces. That is the bypass.

Quick start

$ export PEAK_API_KEY=pk_your_api_key
$ python -m cloudflare_turnstile_bypass --url https://example.com/
0.AgAAABBqzz...

Or find the sitekey first, then bypass:

from cloudflare_turnstile_bypass import find_sitekey, bypass_turnstile

sitekey = find_sitekey("https://example.com/")
token = bypass_turnstile("pk_...", sitekey, "https://example.com/")
print(token)  # -> "0.AgAAABBqzz..."

Finding a Turnstile sitekey

Turnstile widgets expose the sitekey in the markup:

<div class="cf-turnstile" data-sitekey="0x4AAAAAAAxxxx"></div>

find_sitekey() reads it for you:

from cloudflare_turnstile_bypass import find_sitekey

sitekey = find_sitekey("https://example.com/")
print(sitekey)  # -> "0x4AAAAAAAxxxx"

Invisible (enterprise) widgets render the same attribute; if a page builds the widget from JavaScript instead, the regex also matches sitekey= and render= in the bundle source.

Bypassing the challenge

from cloudflare_turnstile_bypass import bypass_turnstile

token = bypass_turnstile(
    "pk_your_api_key",          # your Peak key (free, no card)
    "0x4AAAAAAAxxxx",           # the sitekey you found
    "https://example.com/",     # the page URL the widget lives on
)
# token is a valid cf-turnstile-response value

With a proxy (the solve runs on residential infrastructure, so the token matches your exit IP region):

token = bypass_turnstile(
    "pk_your_api_key",
    "0x4AAAAAAAxxxx",
    "https://example.com/",
    proxy="http://user:pass@proxy:8080",
)

Python API reference

Function Purpose
read_page(url) Fetch a page's HTML (plain urllib, no dependencies).
find_sitekey(url) Extract the Turnstile sitekey from a page or HTML string.
find_action(html) Extract an optional data-action value.
bypass_turnstile(api_key, sitekey, url) Solve the challenge and return a ready token.
token_for_page(api_key, url) Find + bypass in a single call, returns BypassResult.

BypassResult carries .token, .sitekey, and the raw solver response.

CLI usage

$ python -m cloudflare_turnstile_bypass --url https://example.com/login
0.AgAAABBqzz...

$ python -m cloudflare_turnstile_bypass --url https://example.com/login --proxy http://user:pass@proxy:8080

Exit code 0 + the token on stdout - pipe it straight into curl or your E2E test harness.

Examples

See examples/submit_bypass.py for an end-to-end flow: find the sitekey, bypass the challenge, and POST the token with your form payload.

Why a solver beats headless browsers

This package uses Peak to solve Turnstile.

  • Solve Cloudflare Turnstile & the 5s challenge in about a second
  • Pay only for successful solves - from $0.8 / 1,000
  • 1,000 free solves to start - no card. Grab 1,000 free solves

Get your free API key · Docs · Pricing

License

MIT - see LICENSE.

cloudflare-turnstile-bypass (henryzawadzki6542/cloudflare-turnstile-bypass)

bot-detection
Searching Database…

614 ·GitHub
Cloudflare-turnstile-bypass
What is this?A dependency-free Python library and CLI that finds the Cloudflare Turnstile sitekey on a page and solves the challenge through a third-party API, handing you a valid cf-turnstile-response token to use in your own requests.
Is this a standalone solver or a wrapper around a paid service?It is a thin Python library (plus a CLI) that only finds the sitekey and formats the request; the actual solving is done by a paid third-party service called Peak, not by this package itself.
How do I use it to get a token?Call findsitekey(url) to extract the sitekey, then bypassturnstile(apikey, sitekey, url) to solve it, or use tokenforpage(apikey, url) to do both in one call; the CLI prints the token straight to stdout for piping into curl or a test harness.
Do I need a Peak API key?Yes, you need a Peak API key to actually solve the challenge; Peak gives 1,000 free solves to start with no card required, then charges from $0.8 per 1,000 solves.
Does this attack Cloudflare's servers directly?No. The project explicitly states it never attacks Cloudflare's edge; it only locates the sitekey, has Peak solve that specific challenge, and injects the resulting signed token into your request like a browser normally would.
Why not just use a headless browser like Selenium or Playwright instead?Turnstile fingerprints the browser environment, so headless Chrome and CDP automation are exactly what it is built to detect. This package skips the browser entirely, needs no matching Chromium build in CI, and only costs money on successful solves instead of burning compute on failed headless runs.
What is Peak?Peak is the external solving service this library calls to actually complete the Turnstile challenge. It advertises solving Turnstile and the 5-second challenge in about a second using residential-IP infrastructure.
Can I route the solve through a proxy?Yes, bypassturnstile accepts a proxy so the solve runs on residential infrastructure matching your exit IP region, keeping the token's geography consistent with the request you'll send.
Does it work on invisible/enterprise Turnstile widgets?Yes, findsitekey also handles invisible (enterprise) widgets since they expose the same sitekey attribute, and it falls back to a regex match against sitekey= and render= in the page's JavaScript bundle if the widget is built dynamically.
What are similar projects?cloudflare-turnstile-solver, nopecha-extension, captcha-api, botasaurus, undetected-chromedriver, turnstile-bypass, invisible_puppeteer, SeleniumBase
Which topics is it in?captcha-solving, qa, anti-bot, bot-detection, captcha, cloudflare, web-scraping, ci, http, security-tools, proxy, command-line-tool
Creator
henryzawadzki6542
Size
0.5 MB
Stars
614
Updated
CommitOct 12
Age
1mo
Commits · 90 Days