To solve a Symfony Panther CAPTCHA, read the sitekey from the page Panther has open and pass it with the current URL to the recaptcha method of the CapSkip PHP SDK. Then write the token into the hidden g-recaptcha-response textarea with executeScript and submit by clicking the form’s own button. The write is where Panther code usually breaks. reCAPTCHA keeps that textarea at display:none, so every Panther helper that would fill it, the Form object and sendKeys alike, throws ElementNotInteractableException. Pages that submit from a reCAPTCHA callback need one more step, because they ignore the field until the callback runs. This guide covers the setup on Windows, the solve, the write, both kinds of submit and the waits that keep the run reliable.<\/p>\n
# PHP 8.1+; bdi fetches the chromedriver that matches your Chrome\ncomposer require symfony\/panther capskip\/capskip\ncomposer require --dev dbrekelmans\/bdi\nvendor\\bin\\bdi detect drivers<\/pre>\n<\/div>\nThe last line is the Windows form of the command; on Linux or macOS it is vendor\/bin\/bdi. It saves chromedriver.exe in a drivers folder inside your project. Panther looks in that folder on its own, but on Windows the lookup is a trap. It finds the file, then fails to start it from the relative path. The error reads "Could not start chrome", followed by a cmd.exe message that a command is not recognized. Pass the driver’s full path to createChromeClient, as every sample here does, or put the drivers folder on PATH.<\/p>\n
Step 1: open the page and read the sitekey<\/h2>\n
Panther starts a headless Chrome through chromedriver and loads the page. reCAPTCHA’s api.js then builds the widget and adds a textarea with the id g-recaptcha-response, so waiting for that element is the reliable sign the widget is ready. Do not wait for it to become visible: it never does, and waitForVisibility on it times out.<\/p>\n
\n<?php\n\/\/ composer require symfony\/panther capskip\/capskip\nrequire __DIR__ . '\/vendor\/autoload.php';\n\nuse Symfony\\Component\\Panther\\Client;\n\n\/\/ The full path: on Windows, Panther finds drivers\\chromedriver.exe on\n\/\/ its own but then fails to start it from the relative path.\n$client = Client::createChromeClient(__DIR__ . '\/drivers\/chromedriver.exe');\n$client->request('GET', 'https:\/\/example.com\/signup');\n\n\/\/ api.js adds the hidden textarea once the widget has rendered.\n$client->waitFor('#g-recaptcha-response', 20);\n$crawler = $client->getCrawler();\n$sitekey = $crawler->filter('[data-sitekey]')->attr('data-sitekey');<\/pre>\n<\/div>\nMost pages declare the widget with a div that carries a data-sitekey attribute. A page that builds it from its own script with grecaptcha.render has no such attribute, but the key is still on the page, in the address of the widget’s iframe. On those pages, use this block in place of the last line of Step 1:<\/p>\n
\n\/\/ grecaptcha.render() pages have no data-sitekey; the key is the\n\/\/ k= parameter of the widget's iframe.\n$src = $crawler->filter('iframe[title="reCAPTCHA"]')->attr('src');\nparse_str((string) parse_url($src, PHP_URL_QUERY), $query);\n$sitekey = $query['k'] ?? '';<\/pre>\n<\/div>\nStep 2: solve it with the PHP SDK<\/h2>\n
The CapSkip PHP SDK needs the sitekey and the URL of the page the widget runs on. Take the URL from Panther rather than from your own variable: after a redirect, the page Panther has open is the one the token has to be minted for.<\/p>\n
\nuse CapSkip\\CapSkip;\n\n$solver = new CapSkip(['host' => '127.0.0.1', 'port' => 8080]);\n\n\/\/ The page Panther has open, after any redirect, so the token is minted\n\/\/ for the URL the form really lives on.\n$result = $solver->recaptcha($sitekey, $client->getCurrentURL());\n$token = $result['code']; \/\/ the result holds captchaId and code<\/pre>\n<\/div>\nAn invisible widget shows up in one of two ways: a div with a data-size attribute set to invisible, or a data-sitekey on the submit button itself. For either, pass an options array with invisible set to 1 as the third argument. A test solve of Google’s public test sitekey through a real CapSkip took about 13 seconds and returned a token of 1,678 characters.<\/p>\n
The PHP SDK is synchronous, so the script blocks until the token comes back, and that is fine. Panther’s browser simply waits on the page, because php-webdriver’s timeouts apply to each command, not to the gaps between them. A session kept open through a 103-second solve still injected and submitted normally afterwards. The SDK polls for up to its recaptchaTimeout, 300 seconds by default, and a timeout key in the options array changes that for one call. What does run out is the token. A reCAPTCHA token is good for about two minutes after it is issued<\/a>, so write and submit it straight away.<\/p>\n
Step 3: write the token with executeScript<\/h2>\n
This is the step that decides whether a Symfony Panther CAPTCHA run works. The obvious move is to set the field through Panther’s Form object, and it fails. Panther fills fields the way a user would, by clearing them and typing into them through WebDriver, and WebDriver refuses to type into an element nobody can see. Setting the field on the Form, calling setValues, passing it to submit or calling sendKeys on the element all end in the same ElementNotInteractableException. Set the value in the page instead:<\/p>\n
\n\/\/ Throws ElementNotInteractableException: the textarea is display:none.\n\/\/ $form['g-recaptcha-response'] = $token;\n\n$client->executeScript(\n 'document.getElementById("g-recaptcha-response").value = arguments[0];',\n [$token]\n);<\/pre>\n<\/div>\nexecuteScript passes each item of the PHP array to the script as arguments[0], arguments[1] and so on, so the token never has to be escaped into the JavaScript string. Visible fields such as an email address still take Panther’s normal form API.<\/p>\n
Step 4: submit by clicking the real button<\/h2>\n
How you submit changes what the page sees. Build the form from its button and Panther submits it by clicking that button, which is what a visitor does:<\/p>\n
\n\/\/ Built from its button, the form is sent by clicking that button, so the\n\/\/ page's own submit handlers and HTML5 validation run as for a visitor.\n$form = $client->getCrawler()->selectButton('Sign up')->form();\n$form['email'] = 'YOUR_EMAIL';\n$client->submit($form);\n\n\/\/ Wait for something only the next page has; getCrawler() can lag.\n$client->waitFor('#welcome', 15);\necho $client->getTitle(), PHP_EOL;<\/pre>\n<\/div>\nThe other ways to submit leave things out, which matters on pages whose own script adds a field or checks the form on submit:<\/p>\n
\n\n
\n \nHow the form is sent<\/th>\n Page’s submit handlers run<\/th>\n HTML5 validation<\/th>\n Button name and value posted<\/th>\n<\/tr>\n<\/thead>\n \n Panther submit on a form built from its button<\/td>\n Yes<\/td>\n Yes<\/td>\n Yes<\/td>\n<\/tr>\n \n Panther submit on a form built from the form element<\/td>\n Yes<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n \n form.submit() run through executeScript<\/td>\n No<\/td>\n No<\/td>\n No<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Validation cuts both ways. A required field left empty, or a value an email field will not accept, stops the click without any error in PHP, and nothing is posted. That is one reason the block above waits for an element that only the next page has. The other is that Panther’s crawler can still describe the old page for a moment after a submit, so code that reads getCrawler() straight away may see the form again.<\/p>\n
Step 5: pages that submit from a callback<\/h2>\n
Some sites have no ordinary submit at all. The widget carries a data-callback attribute, or the page passes a callback to grecaptcha.render, and that function submits the form once reCAPTCHA hands it a token. Invisible widgets almost always work this way. On those pages, a token in the textarea does nothing until the callback runs, so call it yourself. Write the textarea first, because the callback usually posts the form and the server reads the token from that field. The script below does both, and on a page with several widgets it calls the first callback it finds:<\/p>\n
\n\/\/ Writes the token into every reCAPTCHA textarea, then calls the widget's\n\/\/ callback if it has one. ___grecaptcha_cfg is undocumented, so the walk\n\/\/ looks for the object holding the sitekey instead of fixed key names.\nconst SUBMIT_TOKEN_JS = <<<'JS'\nvar token = arguments[0], found = null, seen = [];\ndocument.querySelectorAll('textarea[name="g-recaptcha-response"]')\n .forEach(function (t) { t.value = token; });\nfunction walk(o, depth) {\n if (found || !o || typeof o !== 'object' || depth > 6 || seen.indexOf(o) !== -1) return;\n if (o instanceof Node || o === window) return;\n seen.push(o);\n if (Object.prototype.hasOwnProperty.call(o, 'sitekey') && o.callback) { found = o.callback; return; }\n for (var k in o) {\n if (Object.prototype.hasOwnProperty.call(o, k)) { try { walk(o[k], depth + 1); } catch (e) {} }\n }\n}\nif (window.___grecaptcha_cfg) {\n Object.keys(___grecaptcha_cfg.clients).forEach(function (id) { walk(___grecaptcha_cfg.clients[id], 0); });\n}\nif (typeof found === 'string') found = window[found];\nif (typeof found !== 'function') return 'no callback';\nfound(token);\nreturn 'callback called';\nJS;\n\necho $client->executeScript(SUBMIT_TOKEN_JS, [$token]), PHP_EOL;<\/pre>\n<\/div>\nreCAPTCHA keeps each widget’s settings in a global object called ___grecaptcha_cfg. A data-callback attribute ends up there as the function’s name, and a callback passed to grecaptcha.render ends up there as the function itself, so the script handles both. The object is undocumented and its inner key names are minified, which is why the script searches for the settings rather than following a fixed path. If Google ever restructures it, the script returns no callback, and on a data-callback page you can still read the attribute and call the function by that name. Calling the callback without writing the textarea is the one mistake to avoid: the form goes out with an empty g-recaptcha-response.<\/p>\n
Full working example<\/h2>\n
Here is the whole Symfony Panther CAPTCHA run in one script. It reads the key from either kind of page, solves, writes the token, and lets the callback submit when there is one or clicks the button when there is not.<\/p>\n
\n<?php\n\/\/ composer require symfony\/panther capskip\/capskip\n\/\/ signup.php: run from the project folder with php signup.php\nrequire __DIR__ . '\/vendor\/autoload.php';\n\nuse CapSkip\\CapSkip;\nuse CapSkip\\Exceptions\\CapSkipError;\nuse CapSkip\\Exceptions\\ValidationException;\nuse Symfony\\Component\\Panther\\Client;\n\nconst PAGE_URL = 'https:\/\/example.com\/signup';\n\n\/\/ Writes the token into every reCAPTCHA textarea, then calls the widget's\n\/\/ callback if it has one. ___grecaptcha_cfg is undocumented, so the walk\n\/\/ looks for the object holding the sitekey instead of fixed key names.\nconst SUBMIT_TOKEN_JS = <<<'JS'\nvar token = arguments[0], found = null, seen = [];\ndocument.querySelectorAll('textarea[name="g-recaptcha-response"]')\n .forEach(function (t) { t.value = token; });\nfunction walk(o, depth) {\n if (found || !o || typeof o !== 'object' || depth > 6 || seen.indexOf(o) !== -1) return;\n if (o instanceof Node || o === window) return;\n seen.push(o);\n if (Object.prototype.hasOwnProperty.call(o, 'sitekey') && o.callback) { found = o.callback; return; }\n for (var k in o) {\n if (Object.prototype.hasOwnProperty.call(o, k)) { try { walk(o[k], depth + 1); } catch (e) {} }\n }\n}\nif (window.___grecaptcha_cfg) {\n Object.keys(___grecaptcha_cfg.clients).forEach(function (id) { walk(___grecaptcha_cfg.clients[id], 0); });\n}\nif (typeof found === 'string') found = window[found];\nif (typeof found !== 'function') return 'no callback';\nfound(token);\nreturn 'callback called';\nJS;\n\n$solver = new CapSkip([\n 'apiKey' => getenv('CAPSKIP_API_KEY') ?: 'capskip',\n 'host' => getenv('CAPSKIP_HOST') ?: '127.0.0.1',\n 'port' => (int) (getenv('CAPSKIP_PORT') ?: 8080),\n]);\n\/\/ The full path: on Windows, Panther finds drivers\\chromedriver.exe on\n\/\/ its own but then fails to start it from the relative path.\n$client = Client::createChromeClient(__DIR__ . '\/drivers\/chromedriver.exe');\n\ntry {\n $client->request('GET', PAGE_URL);\n \/\/ api.js adds the hidden textarea once the widget has rendered.\n $client->waitFor('#g-recaptcha-response', 20);\n $crawler = $client->getCrawler();\n\n $box = $crawler->filter('[data-sitekey]');\n if ($box->count() > 0) {\n $sitekey = $box->attr('data-sitekey');\n } else {\n \/\/ grecaptcha.render() pages: the key is the k= parameter of the widget iframe.\n $src = $crawler->filter('iframe[title="reCAPTCHA"]')->attr('src');\n parse_str((string) parse_url($src, PHP_URL_QUERY), $query);\n $sitekey = $query['k'] ?? '';\n }\n\n \/\/ Visible fields take typing as usual.\n $form = $crawler->selectButton('Sign up')->form();\n $form['email'] = 'YOUR_EMAIL';\n\n $token = $solver->recaptcha($sitekey, $client->getCurrentURL())['code'];\n\n if ($client->executeScript(SUBMIT_TOKEN_JS, [$token]) !== 'callback called') {\n \/\/ No callback: click the real button, as a visitor would.\n $client->submit($form);\n }\n \/\/ Wait for something only the next page has; getCrawler() can lag.\n $client->waitFor('#welcome', 15);\n echo 'Submitted: ', $client->getTitle(), PHP_EOL;\n} catch (ValidationException $e) {\n echo 'Not sent: ', $e->getMessage(), PHP_EOL;\n} catch (CapSkipError $e) {\n echo 'Solve failed: ', get_class($e), ': ', $e->getMessage(), PHP_EOL;\n} finally {\n $client->quit();\n}<\/pre>\n<\/div>\nChange the button label, the email field and the selector you wait for to match your page. For an invisible widget, add the options array from Step 2 to the recaptcha call. On a callback page with no button at all, Steps 1, 2 and 5 are the whole job. If waitFor gives up after the click, look at the form before blaming the token: a required field left empty stops the submit with no error at all. For more on the SDK side, including the invisible and Enterprise options, the guide to solving reCAPTCHA v2 in PHP<\/a> covers the recaptcha call without a browser.<\/p>\n
Running Panther and CapSkip on different machines<\/h2>\n
Panther suites often run on a CI runner or a Linux box, while CapSkip is a Windows application. That works fine. Switch CapSkip to Server mode and it listens on your network address or public IP, so Panther on any machine can call it over the same API. Use a static public IP when the route crosses the internet, turn on API key validation, and limit the port to the addresses you expect with a Windows Firewall rule. The solver is still your own Windows machine, and solves are still unmetered.<\/p>\n
The PHP SDK does not read environment variables by itself. Read CAPSKIP_HOST, CAPSKIP_PORT and CAPSKIP_API_KEY in your code and pass them to the constructor, as the full example does, so the same script runs at your desk and in CI. When the host is wrong or CapSkip is not running, the first call fails with a NetworkException that says it failed to connect. That takes about two seconds when nothing listens on the port, and up to 30 seconds, the SDK’s connect timeout, when a firewall drops the connection.<\/p>\n
Common errors and what they mean<\/h2>\n
\n\n
\n \nWhat you see<\/th>\n Cause<\/th>\n Fix<\/th>\n<\/tr>\n<\/thead>\n \n ElementNotInteractableException: element not interactable<\/td>\n Panther tried to type the token into the hidden g-recaptcha-response textarea<\/td>\n Write the value with executeScript, as in Step 3<\/td>\n<\/tr>\n \n Could not start chrome, with a cmd.exe message that a command is not recognized<\/td>\n Windows: Panther found chromedriver in the drivers folder and could not start it from the relative path<\/td>\n Pass the driver’s full path to createChromeClient, or add the drivers folder to PATH<\/td>\n<\/tr>\n \n Could not start chrome, with a message that the system cannot find the path<\/td>\n There is no chromedriver.exe at the path passed to createChromeClient<\/td>\n Run bdi detect drivers in the project folder, or correct the path<\/td>\n<\/tr>\n \n SessionNotCreatedException: This version of ChromeDriver only supports Chrome version N<\/td>\n Chrome updated itself and the driver did not<\/td>\n Run bdi detect drivers again<\/td>\n<\/tr>\n \n RuntimeException: The port 9515 is already in use.<\/td>\n Another Panther client or script already holds chromedriver’s default port<\/td>\n Give each client its own port in the options array of createChromeClient<\/td>\n<\/tr>\n \n The token is written and nothing happens<\/td>\n The page submits from a reCAPTCHA callback<\/td>\n Run the Step 5 script, which writes the field and calls the callback<\/td>\n<\/tr>\n \n waitFor times out after the click and nothing was posted<\/td>\n A required field was empty, or a value failed the field’s validation<\/td>\n Fill every required field with a valid value before you submit<\/td>\n<\/tr>\n \n NetworkException: Failed to connect to 127.0.0.1 port 8080<\/td>\n CapSkip is not running, or the host and port are wrong<\/td>\n Start CapSkip, then check whether it should be in Local mode or Server mode<\/td>\n<\/tr>\n \n Maximum execution time exceeded during a solve<\/td>\n Panther runs inside a web request, and on Windows that limit counts time spent waiting<\/td>\n Run Panther from the command line, where the limit is off, or from a queue worker<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n FAQ<\/h2>\n
\n\n
Does headless Chrome make the CAPTCHA harder to pass?<\/h3>\n<\/summary>\n
Not for this approach. The challenge is solved in CapSkip’s own browser, not in the Chrome that Panther drives, so Panther’s browser never has to pass it. Panther only carries the finished token into the form. To watch the run, set PANTHER_NO_HEADLESS to 1 in the environment before you start PHP. Panther reads it from $_SERVER, so a putenv() call inside the script has no effect.<\/p>\n<\/details>\n
\n\n
Should my own app’s Panther tests use a solver?<\/h3>\n<\/summary>\n