A k6 captcha step has to go through the raw HTTP API, because k6 is not Node and the SDK cannot be installed into it. That is the easy part: two calls, submit and poll. The part that decides whether your test is worth anything is where the solve runs. Put it in the default function and every virtual user solves on every iteration, which measures the solver instead of your application and floods a machine that was never meant to take that. Put it in the setup stage and you get clean numbers, with one honest limit you need to know about.<\/p>\n
Say this plainly before writing any code. If the site under test is yours, the better move is usually to let the load generator past the challenge: allowlist its address, or send a header your staging environment recognises, and skip the widget entirely. You are trying to measure your application, and every solved challenge adds latency that belongs to somebody else.<\/p>\n
Solving is the right call in two cases. The endpoint you need to hit is protected and you do not control that protection, or the protected path itself is the thing under test and skipping it would test a route real traffic never takes. Both are real, and both are what the rest of this post is for.<\/p>\n
k6 scripts look like JavaScript and are not running on Node. The require implementation is k6’s own, and the documentation is blunt about the limit: it loads built-in k6 modules, local files and remote scripts, and it does not support the Node module resolution algorithm. No npm, no node_modules, no fs and no crypto. So the CapSkip package cannot be imported, and neither can anything else you might reach for.<\/p>\n
This costs less than it sounds. The API is 2captcha compatible and has two endpoints, so k6’s own http module covers it in about fifteen lines. If your load generator turns out to be a plain Node process after all, the Node.js CAPTCHA solver page<\/a> covers the client that does have an SDK.<\/p>\n Submit to in.php, get an ID, then poll res.php until the answer arrives. Ask for JSON so you are reading fields instead of splitting strings on a pipe character.<\/p>\n Note the parameter name. reCAPTCHA wants googlekey, while Turnstile wants sitekey with the turnstile method. Sending the wrong one is the usual cause of an ERROR_GOOGLEKEY response.<\/p>\n A pending answer comes back as CAPCHA_NOT_READY with a status of zero, which is why the loop checks the status field rather than treating any response as done. Results are readable once, so keep the token when you get it.<\/p>\n k6 runs setup once, before any virtual user starts, and passes whatever it returns into the default function. That is exactly the shape this needs. Solve there, hand the tokens out, and no VU pays for a solve inside its own iteration.<\/p>\n The setupTimeout line matters more than it looks. k6 gives setup 60 seconds by default, and a single reCAPTCHA solve can use most of that on its own. Ten of them will not fit, the stage is killed, and the error blames setup rather than anything you would think to look at.<\/p>\n Tokens are single use and stay valid for roughly two minutes. Both halves bite here. Single use means you need at least as many tokens as protected requests, so a test that hits the guarded endpoint a thousand times needs a thousand solves and no longer resembles a load test. Two minutes means the tokens you solved in setup are already ageing when the first VU starts, so a long soak test will spend most of its run submitting expired ones.<\/p>\n So this pattern fits a short burst against a protected endpoint, not a thirty minute soak. The post on how long a reCAPTCHA token stays valid<\/a> has the timings. If you need sustained load through the widget, the allowlist route from earlier is the only honest way to get it.<\/p>\n Anything you send with k6’s http module lands in http_req_duration, solver calls included. A p95 that quietly includes a fifteen second poll is not a number you can act on. Tag the requests you care about and point the thresholds at the tag.<\/p>\n The __VU variable numbers virtual users from one, so indexing the token array with it gives each VU its own. Tagging is the cleaner fix than moving the solve somewhere k6 cannot see, because the solve requests still show up in the output when you want to know how long they took.<\/p>\n Load generators are rarely your desktop. k6 runs in CI, on a dedicated box, or on a managed service, and the loopback address on any of those is not the machine your solver is on.<\/p>\nStep 1: write the solve as a plain function<\/h2>\n
\/\/ No install step. Both modules are built into k6.\nimport http from 'k6\/http';\nimport { sleep } from 'k6';\n\nconst SOLVER = 'http:\/\/127.0.0.1:8080';\nconst KEY = 'YOUR_API_KEY';\n\nfunction solve(sitekey, pageurl) {\n const submitted = http.post(SOLVER + '\/in.php', {\n key: KEY,\n method: 'userrecaptcha',\n googlekey: sitekey,\n pageurl: pageurl,\n json: '1',\n });\n\n return poll(submitted.json('request')); \/\/ the captcha ID\n}<\/pre>\n<\/div>\nfunction poll(id) {\n const url = SOLVER + '\/res.php?key=' + KEY +\n '&action=get&json=1&id=' + id;\n\n \/\/ Roughly three minutes of headroom at five seconds a try.\n for (let i = 0; i < 36; i++) {\n sleep(5);\n const res = http.get(url);\n if (res.json('status') === 1) {\n return res.json('request'); \/\/ the token\n }\n }\n throw new Error('solve did not finish in time');\n}<\/pre>\n<\/div>\nStep 2: solve in the setup stage<\/h2>\n
const PAGE = 'https:\/\/example.com\/page-with-recaptcha';\nconst SITEKEY = 'YOUR_SITEKEY';\n\nexport const options = {\n vus: 10,\n duration: '90s',\n setupTimeout: '5m', \/\/ the 60s default expires mid solve\n};\n\nexport function setup() {\n \/\/ One token per VU. They are single use.\n const tokens = [];\n for (let i = 0; i < 10; i++) {\n tokens.push(solve(SITEKEY, PAGE));\n }\n return { tokens };\n}<\/pre>\n<\/div>\nThe limit worth knowing before you build on this<\/h2>\n
Step 3: keep the solver out of your metrics<\/h2>\n
export const options = {\n vus: 10,\n duration: '90s',\n setupTimeout: '5m',\n thresholds: {\n \/\/ Measure the app, not the solve.\n 'http_req_duration{target:app}': ['p(95)<500'],\n },\n};\n\nexport default function (data) {\n const token = data.tokens[__VU - 1];\n\n http.post(PAGE, { 'g-recaptcha-response': token }, {\n tags: { target: 'app' },\n });\n}<\/pre>\n<\/div>\nWhere the solver has to live<\/h2>\n