API Reference

All endpoints accept JSON bodies. Each dedicated endpoint maps to a specific mode. The /bypass master endpoint accepts any mode via the mode field. Pass useProxy: true to route through the internal proxy pool — no proxy config needed.

⚡ Master Endpoint

POST/bypassAll modes in one
Field Type Required Description
url string required Target URL
mode string required cloudflare · turnstile-min · turnstile-max · source · waf-session
siteKey string optional* Required when mode is turnstile-min
useProxy boolean optional Route through internal proxy pool (default: false)
proxy object optional Override proxy: {"host","port","username?","password?"}
waitFor number optional Extra ms to wait after CF clears — cloudflare mode only (max 15000)
getSource boolean optional Return full HTML source — cloudflare mode only
login object optional Auto-login config — see Login section
actions array optional Browser actions after navigation — see Actions section
setCookies array optional Inject cookies before navigation: [{name,value,domain}]

Example — Turnstile Min

POST /bypass
{
  "url": "https://www.createimg.com/",
  "mode": "turnstile-min",
  "siteKey": "0x4AAAAAABggkaHPwa2n_WBx"
}

Example — Cloudflare Full Bypass

{
  "url": "https://example.com/",
  "mode": "cloudflare",
  "waitFor": 6000,
  "getSource": true,
  "useProxy": true
}

Response — cloudflare mode

{ "success": true, "data": {
  "cf_clearance": "ANhX...", "__cf_bm": "abc...",
  "token": "0.xyz...", // only if siteKey passed
  "cookies": [...], "sessionCookies": {}, "userAgent": "Mozilla...",
  "title": "Page Title", "source": null, "finalUrl": "https://..."
}}

Response — token modes

{ "success": true, "data": { "token": "0.abc123..." } }

🎯 Dedicated Endpoints

POST/turnstile-minFast token, minimal page load

Intercepts the page request and replaces it with a minimal Turnstile render page. Requires siteKey.

{ "url": "https://site.com/", "siteKey": "0x4AAA..." }
POST/turnstile-maxFull page, auto-solve

Loads the full real page and lets the browser's built-in Turnstile solver handle it. No siteKey needed.

{ "url": "https://site.com/" }
POST/cloudflareFull CF bypass + cookies

Bypass Cloudflare WAF and return cf_clearance, all cookies, user agent, and optionally page source. Supports login and custom actions.

{ "url": "https://site.com/", "waitFor": 5000, "getSource": true }
POST/waf-sessionCookies + headers for follow-up requests

Returns cookies and request headers (including Accept-Language as seen by the server). Use with cycletls or got-scraping.

{ "url": "https://site.com/" }
// Response
{ "data": { "cookies": [...], "headers": { "user-agent": "...", "accept-language": "en-US,en;q=0.9" } } }
POST/sourcePage HTML after CF bypass
{ "url": "https://site.com/" }

🔑 Auto Login

Pass a login object to /bypass or /cloudflare to authenticate before extracting session cookies.

{
  "url": "https://site.com/dashboard",
  "mode": "cloudflare",
  "getSource": true,
  "login": {
    "loginUrl": "https://site.com/login",
    "usernameSelector": "input[name='email']",
    "passwordSelector": "input[name='password']",
    "submitSelector": "button[type='submit']",
    "username": "you@example.com",
    "password": "yourpassword",
    "waitAfterLogin": 3000
  }
}

🎮 Custom Actions

Type Fields Description
click selector, wait? Click element by CSS selector
type selector, value, wait? Type text into input
wait ms Wait N milliseconds
navigate url, wait? Navigate to URL (waits for CF)
waitForSelector selector, timeout? Wait for element to appear 
{
  "url": "https://site.com/", "mode": "cloudflare",
  "actions": [
    { "type": "waitForSelector", "selector": "#search" },
    { "type": "type", "selector": "#search", "value": "hello" },
    { "type": "click", "selector": "button[type='submit']", "wait": 2000 }
  ], "getSource": true
}

📡 Utility Endpoints

GET/healthSystem status
GET/statsProxy pool stats
POST/proxies/refreshForce proxy pool refresh
GET/eventsSSE live stream

❌ Error Codes

Code HTTP Description
FAILED 500 Bypass or browser error
TOO_MANY_REQUESTS 429 All browser slots busy
BAD_REQUEST 400 Missing or invalid fields
NOT_READY 503 Browser still starting
UNAUTHORIZED 401 Invalid authToken

⚠️ Proxy testing runs on startup and every 15 min. Pass useProxy: true to opt-in per-request. Without it, requests go direct — no proxy needed in your client code.