Cloudflare Turnstile solver for HTTP / requests Python

Runnable example

import requests
from captchasonic import CaptchaSonic

sonic = CaptchaSonic('YOUR_API_KEY')
result = sonic.solve(
    type='TurnstileTaskProxyless',
    website_url='https://target.example.com/login',
    website_key='0x4AAAAAAA...',
)

r = requests.post(
    'https://target.example.com/login',
    data={'username': '...', 'password': '...', 'cf-turnstile-response': result.token},
)
print(r.status_code)

Replace YOUR_API_KEY with a real key from your dashboard. The token is good for one form submission.

FAQ

Is requests enough for Turnstile?

Yes for the captcha itself. Cloudflare may still TLS-fingerprint your client, so pair with a curl-impersonate-style HTTP client if your target enforces JA3/JA4 strict-matching.

What if the form posts JSON, not form-encoded?

Set cf-turnstile-response as a key in the JSON body — Cloudflare reads whatever the page declared. Most Turnstile sites accept form-encoded, but a few enforce content-type strictness.

How long is a Turnstile token valid?

About 5 minutes per origin. The token is single-use on the verify endpoint, so submit the form immediately after receiving it.

Other Cloudflare Turnstile stacks

• Cloudflare Turnstile · Playwright · PythonPass Cloudflare Turnstile from Playwright Python. Sonic returns the cf-turnstile-response token in under 7 seconds, ready to drop into the page.
• Cloudflare Turnstile · Puppeteer · Node.jsBypass Cloudflare Turnstile with Puppeteer in Node.js. Sonic returns the cf-turnstile-response token in under 7 seconds.
• reCAPTCHA v3 · HTTP / requests · PythonSolve reCAPTCHA v3 from a pure-requests Python script. No browser, no Selenium — just the action-bound token.
• AWS WAF · HTTP / requests · PythonPass the AWS WAF captcha challenge from a pure-requests Python script. Sonic returns the aws-waf-token cookie for subsequent requests.