Product
Captcha bypass API: the page, not a token
The Automation API is an HTTP gateway. You send your existing request to it, name the real target in headers, and once the shield is cleared it hands back the origin's own status line, headers and body. There is no task object and nothing to poll, so if your code already parses the page, the only thing that changes is where the request is addressed.
[ 01 ]How a request travels
How a request travels
The whole difference between our two products is where your request stops.
- 01
Change the destination, keep the request
Method, path, query string and body stay exactly as they are. The real host moves into x-nc-host, your key into x-nc-key, and the request goes to the gateway instead of the origin.
- 02
The gateway clears the shield
x-nc-fingerprint selects the TLS and browser profile the target is matching against; x-nc-proxy sends the request out through your own exit IP. An interstitial is solved in place, and a captcha embedded in the flow is handed to the solving engine without the request unwinding.
- 03
You get the target's response
Status, headers and body come back as the origin sent them, with content-length corrected for decoding. The response header x-nc-status: ok marks a request that cleared, and that is the one you are billed for.
- 04
Reuse the cleared session
x-nc-session partitions sessions under an id you choose. Later pages sent with the same id ride the state that already cleared, instead of paying for a fresh challenge on every URL.
[ 02 ]What it gets through
What it gets through
- Cloudflare ChallengeReturns the page behind Just a moment; there is no cf_clearance for you to pin to an IP.
- Cloudflare TurnstileThe widget is solved inside the session and the result is injected, so the next request goes straight through.
- DataDomeInterstitial and slider handled at the gateway; the datadome cookie stays on the session.
- Imperva IncapsulaThe ___utmvc bootstrap runs server side, you never see the reese84 exchange.
- Akamai Bot ManagerSensor data is generated per session and the _abck cookie is maintained for you.
- KasadaThe x-kpsdk headers are produced and refreshed on the session, not by your client.
- PerimeterX / HUMANPress-and-hold is handled in place and the _px cookies ride along with the session.
- AWS WAF CaptchaThe token is minted and attached before the request is replayed at the origin.
- Embedded challengesreCAPTCHA, hCaptcha and GeeTest that appear mid-flow go to the solving engine and come back into the same request.
[ 03 ]What you get
What you get
50,000
requests/minute
Concurrency
The default key runs 50,000 requests per minute. There is no per-second ceiling to design a queue around, and the limit is raised on the account rather than sold as a tier.
4.8s
median, p95 11.2s
Time to a cleared response
Measured end to end across the engine, from the request arriving to the origin's response leaving.
99.4%
cleared and returned
Acceptance
Share of requests that came back carrying the origin's own response. Anything else is an error body and is not billed.
Balance does not expire
You buy balance, not a dated package. Unused balance stays on the account and is spendable on either product, in any month.
[ 04 ]Five lines, any language
Five lines, any language
# The path and query string are your target's. Only the host changes.
curl -s "https://gateway.nexcaptcha.net/product/12345?ref=list" \
-H "x-nc-key: YOUR_API_KEY" \
-H "x-nc-host: shop.example.com" \
-H "x-nc-fingerprint: chrome-131-win" \
-H "x-nc-proxy: http://user:[email protected]:8000" \
-H "x-nc-session: catalog-42" \
-D headers.txt -o page.html
# headers.txt carries "x-nc-status: ok" when the request cleared and was billed.
# page.html is what shop.example.com would have returned to a browser.[ 05 ]What it costs
What it costs
Both products bill from one rate card, per 1,000 successful requests, priced by the challenge the page actually put up: $0.75 image-to-text, $1.50 reCAPTCHA v2, $2.18 Turnstile and DataDome, $4.49 Cloudflare Challenge, GeeTest v4, Akamai, Kasada and PerimeterX. The gateway is not a surcharge — the same shield on the same page costs the same whether you take the response or the token — and a request that does not clear is not billed.
Cloudflare Challenge
$4.49per 1,000
Cloudflare Turnstile
$2.18per 1,000
DataDome
$2.18per 1,000
Imperva Incapsula
$4.49per 1,000
Akamai Bot Manager
$4.49per 1,000
Kasada Bot Defense
$4.49per 1,000
PerimeterX Press & Hold
$4.49per 1,000
AWS WAF Captcha
$2.18per 1,000
[ 06 ]Which one fits
Which one fits
Pick this one when
- The whole page is behind an interstitial and the only thing you want out of it is the HTML.
- Your crawler is plain HTTP, and reproducing a TLS fingerprint, a cookie jar and a matching user agent well enough for a token to be accepted is work you would rather not own.
- You are walking many pages behind one challenge, and x-nc-session carries the cleared state across them at no extra charge.
- You drive Playwright, Puppeteer or Selenium and want the shield handled underneath the browser, through the upstream-proxy mode.
Pick the other one when
- The captcha sits inside a form you are submitting with your own session, and the POST has to leave from your own IP.
- You need the token itself to hand to something else — a mobile client, a queue, an internal service that owns the HTTP call.
- The page already loads fine and the only obstacle is a standalone widget: reCAPTCHA, GeeTest, an image field.
- Your pipeline is already built around createTask/getTaskResult and all you are missing is the solve step.
[ 07 ]Questions about this one
Questions about this one
Ask where your request should stop. If you want the page, use the Automation API: you send the request, it comes back carrying the origin's response. If you want a token to submit yourself, from your own session and IP, use the Captcha Solving API. Same workers underneath, same prices, different stopping point.
No. Both products price per 1,000 successful requests by the challenge encountered, off the same rate card. A Cloudflare interstitial is $4.49 per 1,000 whether the gateway clears it and hands you the page, or you solve it and attach the cf_clearance yourself. Requests that do not clear are not billed.
Yes. Alongside the header-driven gateway there is an upstream-proxy mode: point the browser's proxy setting at it, use your API key as the proxy username, and the shield is handled below the browser while your selectors stay as they are. Header mode remains available for plain HTTP clients that never start a browser.
One request covers both. The gateway clears the transport-layer shield, and when the page then renders a reCAPTCHA, hCaptcha or GeeTest inside the flow, that challenge goes to the solving engine and the answer is injected before the request continues to the origin. Billing follows the challenge that had to be solved; when two fire in one request, you pay the higher of the two rates once, not both.
The default key runs 50,000 requests per minute, and a higher ceiling is set on the account rather than sold as a tier. Balance does not expire: it is not a dated package, so unused balance stays on the account and is spendable on either product. The gateway is reachable directly from mainland China, so you do not need to place a relay server overseas.
Solve your first thousand on us.
Create a key, paste it into the sample above, and watch a real token come back. No card, no sales call.