Cloudflare Turnstile token service

Turnstile Solver
is online.

Give a page URL and its Turnstile sitekey; a pool of hardened Firefox browsers returns the live cf-turnstile-response token together with the resulting cookies and user-agent. Optional per-request proxy, injection mode for pages that render no widget, and multi-user rate limiting.

View request example View response example API details as JSON

Endpoints

All paths are served under /turnstile. Solve synchronously with wait=true, or fire-and-poll.

POSTGET

/turnstile/solve

Solve a token. With wait=true the response holds until finished and returns the token; otherwise it returns a task_id to poll.

GET

/turnstile/result?id=

Poll an async task: 202 while pending, 200 with the token when solved, 422 on failure.

GET

/turnstile/health

Live readiness and availability. Exact load numbers are returned only to a configured admin IP.

GET

/turnstile/whoami

Echoes the client IP the service sees through the gateway. Useful for verifying rate-limit identity.

Request parameters

Send as a JSON body on POST or as query-string parameters on GET. Query values override body values.

◎

url required

The page URL that hosts (or should host) the Turnstile widget. In inject mode only its origin matters.

sitekey required

The Turnstile widget sitekey (for example 0x4AAAAAAA...).

⚡

inject

Default true. Serve a synthetic widget page on the target origin so a token is produced even when the page renders no widget. Set false to solve only a widget the page renders itself.

◷

wait

Default false. true blocks until the solve finishes and returns the full result in one response.

◫

timeout_s

Hard ceiling for the solve. Default 60, clamped to 180.

↯

action / cdata

Optional Turnstile action and cData labels applied to the widget in inject mode.

◎

proxy

Optional per-request outbound proxy as scheme://user:pass@host:port. A dedicated browser is launched for that request.

Request headers

Content-Type: application/json

Required when sending parameters as a JSON body on POST.

X-API-Key: YOUR_API_KEY

Required on this service. Replace with the API key provided by the service owner.

Content-Type: application/json
X-API-Key: YOUR_API_KEY

Example request

Blocking solve with curl against https://solver.mintbin.xyz/turnstile/solve.

curl -X POST "https://solver.mintbin.xyz/turnstile/solve?wait=true" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "sitekey": "0x4AAAAAAA...",
    "inject": true,
    "timeout_s": 60,
    "proxy": "http://user:pass@proxy.example.com:8080"
  }'

Example response

A solved request answers with HTTP 200 shaped like this. Failures answer 422 with {"error": {"code","message"}} or a reason.

{
  "task_id": "3f2a...",
  "status": "solved",
  "token": "0.RD7PWurbnU39z3XF...9a9d691",
  "elapsed_s": 8.29,
  "url": "https://example.com",
  "sitekey": "0x4AAAAAAA...",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; ...) Firefox/152.0",
  "cookies": [
    {
      "name": "cf_clearance",
      "value": "...",
      "domain": "example.com"
    }
  ]
}

Shared service

Rate limits are per client IP. If a request returns HTTP 429, back off and retry rather than increasing pressure. Use only for targets you are authorized to test.