AWS WAF solver for HTTP / requests Python

Runnable example

import requests
from captchasonic import CaptchaSonic

sonic = CaptchaSonic('YOUR_API_KEY')
result = sonic.solve(
    type='AntiAwsWafTask',
    website_url='https://api.example.com/protected',
    user_agent='Mozilla/5.0 (...)',
)

session = requests.Session()
session.cookies.set('aws-waf-token', result.cookie)
r = session.get('https://api.example.com/protected/list')
print(r.status_code)

Replace YOUR_API_KEY with a real key from your dashboard. The token is good for one form submission.

FAQ

How long does the AWS WAF cookie stay valid?

Around 5 minutes per origin in most deployments. Cache the cookie in your session across requests within that window — re-solving on every call is wasted spend.

Does Python requests need any special config?

No. The aws-waf-token cookie is a standard HTTP cookie — set it via session.cookies and continue making requests as usual. The WAF gateway reads it transparently.

What if the page also shows a captcha widget?

Some WAF deployments escalate to a visible captcha. The same AntiAwsWafTask handles both the silent token issuance flow and the visible-widget fallback.

Other AWS WAF stacks

• reCAPTCHA v3 · HTTP / requests · PythonSolve reCAPTCHA v3 from a pure-requests Python script. No browser, no Selenium — just the action-bound token.
• Cloudflare Turnstile · HTTP / requests · PythonPass Cloudflare Turnstile from a pure-requests Python script — no headless browser. Sonic returns the cf-turnstile-response token to POST directly.