[ 01 ]What it looks like
An AWS-branded card with a slide, rotate or shape-match puzzle, then an automatic retry.
Captcha type · Amazon Web Services
AWS WAF captcha solver API
Visible AWS WAF captchas and silent WAF challenges both handled, returning the aws-waf-token your next request has to carry. Only solves are billed.
Also searched asAmazon captchaaws-waf-tokencaptcha_voucherAWSWAFCaptchaAWS WAF challenge
- Price
- $2.18
- per 1,000
- Token acceptance
- 98.4%
- Median solve
- 6.7s
- p95 solve
- 15.1s
[ 02 ]Why it is hard
The challenge bootstraps from page-embedded key, iv and context values, or from a jsapi script URL, and all of them change per request so they have to be scraped live rather than stored. AWS runs a proof-of-work and a silent fingerprint check before the puzzle even renders, and the visible puzzle is only the last step. The deliverable is a captcha_voucher plus an aws-waf-token that the edge binds to the session that requested it.
[ 03 ]How we solve it
We take the key, iv and context straight from your task, run the proof-of-work and the puzzle in one pass, and return captcha_voucher and aws-waf-token together so the retried request carries both. Puzzle models cover the slide, rotate and shape-match rule sets AWS ships, retrained on live traffic as rule sets change. Send proxy and userAgent when the WAF rule also scores the IP; most public rule sets do not need it.
[ 02 ]Solve it in five lines
Solve it in five lines
Post the task, get the token. Our SDKs collapse creation, polling and retries into one call.
aws-waf-captcha.sh
curl -s https://api.nexcaptcha.net/createTask \
-H "Content-Type: application/json" \
-d '{
"clientKey": "YOUR_API_KEY",
"task": {
"type": "AmazonTaskProxyless",
"websiteURL": "...",
"websiteKey": "...",
"iv": "...",
"context": "..."
}
}'Required parameters
- API task type
- AmazonTaskProxyless
- websiteURL
- required
- websiteKey
- required
- iv
- required
- context
- required
- Difficulty
- Hard
[ 03 ]Where this one shows up
Where this one shows up
[ 05 ]Questions about this one
Questions about this one
$2.18 per 1,000 accepted solves, against $1.45 at 2Captcha on the 2026-09-22 benchmark. Only accepted solves are billed. Median return is 6.7s, p95 15.1s, at a 98.4% accepted rate.
The Challenge action runs proof-of-work in the background and never shows a puzzle; the Captcha action shows one. Both end in a token your next request must carry. We handle both through the same task type, and you are billed the same rate.
They are in the blocked page HTML, usually inside the inline script that loads the AWS jsapi. If the site only exposes a jsapi script URL, send that instead of iv and context and we derive the rest. All three values are per-request, so scrape them on the same response you were blocked on.
Usually not. The default AmazonTaskProxyless works because the token is bound to the challenge session, not the solving IP. If your WAF rule pairs the captcha action with a rate-based or IP-reputation rule, send your proxy and userAgent so the token is earned from your exit.
Solve your first thousand on us.
Create a key, paste it into the sample above, and watch a real token come back. No card, no sales call.