No products in the cart.
AWS WAF CAPTCHA
AWS WAF CAPTCHA Solver: Get the aws-waf-token Automatically
Amazon WAF locks a site behind a picture grid or a toy car puzzle until the visitor earns an aws-waf-token cookie. CapSkip earns that cookie for your scripts on a Windows machine you run, for one flat monthly price.
Windows x64·Runs locally, so no CAPTCHA leaves your machine
- Grid and toy car puzzles
- aws-waf-token returned
- Flat monthly price
AWS WAF solves a month40,000
40.0k250.0k
$23.00stays in your pocketevery month, at this volume
When Amazon's web application firewall decides a visitor looks automated, it stops serving the page and asks for proof first. That proof is the AWS WAF CAPTCHA: usually a 3x3 picture grid with an instruction such as "Choose all the curtains" and a Confirm button, sometimes a small puzzle where a toy car has to reach the end of a city street. Get it right and the site sets an aws-waf-token cookie; until then your scraper or bot sees nothing but the challenge.
CapSkip is an AWS WAF CAPTCHA solver you install on a Windows desktop, VPS or server. You pass it the values the challenge carries, and it returns the token your HTTP client needs to carry on, whether the site shows the full-page 405 interstitial or embeds the JavaScript API widget inside a form. No remote solving farm ever learns which Amazon-protected sites you work on.
Metered services typically bill around $1.45 for every thousand AWS WAF solves and charge again for each retry. CapSkip costs the same flat amount from $35 a month whatever your volume, and a tool already written for the legacy in.php / res.php API, Anti-Captcha, CapSolver or CapMonster can send its Amazon WAF jobs to CapSkip without code changes.
The token stays on your side. CapSkip answers AWS WAF CAPTCHA on the machine where the app runs, so the sites you crawl, the challenge values and the cookies you receive never pass through a third-party solving service. Read the setup guide
Built for sites behind Amazon WAF
Picture grid and toy car alike
AWS WAF picks which puzzle a visitor gets. CapSkip answers the "Choose all the..." image grid as well as the toy car path puzzle, so your job never stalls on the one it was not ready for.
Full-page check or embedded widget
Some sites answer with a 405 page that holds the challenge; others place the CAPTCHA widget on a login or checkout form. Both shapes are covered by the same request fields.
The cookie your client is missing
What you get back is the value for the aws-waf-token cookie, or the voucher pair the legacy API returns. Set it, repeat the request, and the protected page loads as normal.
Existing clients keep working
AmazonTask, AntiAwsWafTask and in.php method=amazon_waf requests are understood as they are. Pick the service your code already talks to in the app and keep the code.
Proxies for real volume
One address is plenty while you test. For a steady stream of AWS WAF jobs, attach a proxy to each request or load a pool into the app so the work spreads across many IPs.
Retries are on the house
A token that expired, a page that asked twice, a run that doubled overnight: none of it shows up on your bill, because the plan is priced per machine and nothing is metered.
Three ways to clear AWS WAF CAPTCHA with CapSkip
from capskip import CapSkip
solver = CapSkip(host="127.0.0.1", port=8080)
# Values from the 405 page's window.gokuProps. iv and context are optional:
# leave both out and CapSkip reads them from the page itself.
result = solver.amazon_waf(
sitekey="AQIDAHjcYu/GjX+QlghicBg...", # gokuProps.key
iv="CgAHbCe2GgAAAAAD", # gokuProps.iv
context="zPT0jOl1rQlUNaldX6LUpn4D...", # gokuProps.context
url="https://example.com/products",
)
# POST this pair to the voucher endpoint beside challenge.js for the cookie.
print(result["captcha_voucher"], result["existing_token"])In Python it is a single call: pass the values from window.gokuProps and the page address, and get back the voucher pair the site trades for the aws-waf-token cookie.
In Chrome or Firefox
With the CapSkip extension added and the app open, an AWS WAF challenge page you hit while browsing is answered for you and the page reloads with its cookie in place.
From your own scripts
Send the challenge values over plain HTTP from Python, Node.js, PHP, C# or anything else that can make a request, and read back the token a moment later.
Through an existing client
Tools that already submit AWS WAF jobs to a solving service in a supported format can be pointed at CapSkip instead, with the same requests and responses.
From install to your first aws-waf-token
-
Set up CapSkip on Windows
Install the app on the PC, VPS or server that will handle your AWS WAF traffic. Its local API starts with it. Download CapSkip
-
Choose a plan or start the trial
Plans are priced by machine, not by solves. The free trial gives you 3 days and 500 solves to test your own Amazon-protected targets, with no card needed. Compare plans
-
Send your first AWS WAF job
Post the challenge values to CapSkip or switch your current client over in the app, add proxies for volume, and set the returned token as the aws-waf-token cookie. Open the API docs
CapSkip vs metered AWS WAF CAPTCHA solving
Same Amazon WAF challenge, two ways to pay for it: a flat local plan or a bill that grows with every token.
| Feature | CapSkip | Per-solve services |
|---|---|---|
| Price model | One monthly plan from $35, any number of solves | Around $1.45 per 1,000 AWS WAF solves |
| Puzzle types | Image grid and toy car path puzzle | Varies by service |
| Delivery shapes | 405 interstitial page and JS-API widget | Depends on the service |
| Where solving runs | Your own Windows desktop, VPS or server | Their servers, one upload per job |
| Retries after an expired token | Free, nothing is counted | Billed as new solves |
| Client code | Your current in.php or createTask client, unchanged | Their own task format |
| Scaling up | Your hardware and proxy pool set the pace | A shared queue and per-account limits |
Pricing
Stop paying per solve
Choose your license
Bronze License
$35/ month
Instant license activation
Billed monthly. Cancel from your account whenever you like.
Same features. More machines, more throughput.
Every machine solves as fast as its own CPU and memory allow. More machines run more threads at the same time, so Silver solves twice as many CAPTCHAs at once and Gold three times as many.
- Unlimited solving, no daily cap
- Unlimited threads, speed scales with your hardware
- 90% to 100% recognition accuracy
- Drop-in replacement for the major solving service APIs
- Works with almost any tool, no coding required
- REST API, SDKs and a browser extension
- Free training when a new CAPTCHA type appears
- Runs on your machine, nothing leaves it
Every CAPTCHA type CapSkip solves is on every license. See the coverage band
Just want to try it first?
Start with a free 3-day trial and solve 500 CAPTCHAs of any type on your own targets.
How AWS WAF CAPTCHA works, and how to solve it through an API
AWS WAF is the firewall Amazon Web Services puts in front of CloudFront distributions, load balancers and API gateways. Site owners write rules that decide what happens to each request, and one of the available actions is CAPTCHA. When a rule fires, the visitor does not get the page they asked for. They get a puzzle, and only a solved puzzle earns the aws-waf-token cookie that lets later requests through until it expires.
The challenge reaches you in one of two shapes. The common one is an interstitial: the server answers with HTTP status 405 and a small HTML page that defines window.gokuProps (a key, an iv and a context) and loads challenge.js and captcha.js from awswaf.com hosts. The other is the JavaScript API, where the site embeds jsapi.js and calls AwsWafCaptcha.renderCaptcha with its own API key, so the puzzle appears inside a form instead of replacing the page. An AWS WAF solver has to accept either one.
The puzzle itself is usually the image grid: nine photos, one instruction naming an everyday object such as bags, beds, clocks or curtains, and a Confirm button. The second kind asks the visitor to steer a toy car through a small town to the end of its road. There is also an audio option for accessibility. Whichever appears, the outcome your client cares about is the same: a valid token, or on the legacy API a captcha_voucher and existing_token pair that the page exchanges for the cookie.
At scale, plan your network before your code. A single IP is fine for trying CapSkip against a few pages, but a crawler that triggers AWS WAF thousands of times a day should rotate through a proxy pool, either loaded into the CapSkip app or sent with each request through the proxy and proxytype fields. Keep the cookie with the session that asked for it and request a fresh one when the site starts answering 405 again.
What exactly does CapSkip return for an AWS WAF CAPTCHA?
It depends on the API style your client uses. Clients written for AntiAwsWafTask, Anti-Captcha or the CapMonster cookie option get the aws-waf-token value directly. The legacy in.php / res.php flow and AmazonTask return a captcha_voucher together with an existing_token, the pair the site turns into the cookie. Either way, the response has the same fields your code already reads.
Which values do I need to send?
For the 405 challenge page: the page URL plus key, iv and context from window.gokuProps, and the addresses of challenge.js and captcha.js. For the JavaScript API widget: the page URL, the widget API key and the jsapi.js address. A proxy is optional per request. The API docs list every field name for each supported client.
Does CapSkip handle the toy car puzzle as well as the image grid?
Yes. AWS WAF chooses which puzzle a visitor sees, and both the "Choose all the..." picture grid and the toy car path puzzle are answered. Your request does not need to say which one the site will show.
Is the 405 page different from the AWS WAF CAPTCHA widget?
They lead to the same cookie but arrive differently. The 405 interstitial replaces the whole page with a challenge and sends you back to the content once it is solved. The JS-API widget sits inside the site's own page, often on a sign-in or checkout form, and is started by the site's script. CapSkip accepts the inputs of either shape.
Do I need proxies to solve AWS WAF CAPTCHA at volume?
For testing, no: your own connection is enough. For production volume, yes. Firewall rules commonly rate-limit or challenge busy addresses, so spread the work across a proxy pool in the CapSkip app, or pass a proxy with each request. HTTP, HTTPS and SOCKS proxies are all accepted.
Can my existing Amazon WAF captcha code point at CapSkip?
Usually without editing it. CapSkip answers the request formats of the legacy in.php / res.php API (method=amazon_waf), AmazonTask and AmazonTaskProxyless, CapSolver's AntiAwsWafTask and the Anti-Captcha and CapMonster equivalents. Choose the matching service in the app, and the jobs your code already sends are answered locally.
How long does one AWS WAF solve take?
A few seconds in most cases. There is no queue shared with other customers, so the time depends on your machine, your network and the proxy in use. You can run several AWS WAF jobs side by side, and the number of threads is a setting in the app rather than a limit of your plan.
Why choose a flat plan for AWS WAF CAPTCHA instead of paying per solve?
Because AWS WAF tokens expire and busy crawlers ask for them again and again. On a per-solve service each new token is another charge, around $1.45 per thousand. CapSkip charges per PC instead: the Bronze tier covers one for $35 monthly, setup is free, and repeat solves change nothing on the invoice.
Get past AWS WAF CAPTCHA without a per-token bill
Install CapSkip, sign in, and send your AWS WAF challenges to your own machine. Grid puzzles, toy car puzzles and expired-token retries are all covered by one monthly plan.