Skip to content
NexCaptcha

Migration guide

Switching from 穿云API (Cloudbypass)

Same header-driven gateway, renamed headers: x-cb-* becomes x-nc-*. Plus DataDome, Akamai and embedded reCAPTCHA, which Cloudbypass cannot solve.

API compatibilityBespoke API — a small shim is needed

What they do well

  • It solves a different and genuinely harder problem than token vendors: the full Cloudflare interstitial JS challenge and Incapsula, at the HTTP transport layer. You get the target page back, not a token you still have to replay with a matching fingerprint.
  • Protocol-level rather than browser-level, so there is no Chromium process per worker. CPU and memory per concurrent request are an order of magnitude below Selenium, Puppeteer or Playwright, and it containerises cleanly.
  • Integration is close to free for existing scraping code: keep the request, change the host, add two headers. Their Python SDK is a requests-shaped Session object, so most call sites do not move at all.
  • Fingerprint control is exposed as plain headers — x-cb-fp for the TLS and browser fingerprint, plus origin, referer, cookie and user-agent overrides. Most token vendors hide that layer and then fail because your fingerprint does not match the token.
  • The x-cb-part session partition (0–999) is a thoughtful design: pass a challenge once, then reuse that session for ten minutes at 1 credit per request instead of 3. It suits crawling many pages behind one challenge.
  • Serious Chinese-market coverage: Chinese documentation, Chinese-language support, Alipay and USDT payment, and an established local brand. Most Western vendors do not serve that segment at all.
  • V1 ships its own rotating proxy pool, so simple cases need no proxy setup. The error-code documentation is complete, and the online code generator lets you test whether a target is reachable before paying anything.

Where they fall short

  • It covers Cloudflare, Turnstile and Incapsula, and nothing else. Our Automation API is used the same way and covers those three plus DataDome, Akamai, Kasada, PerimeterX and AWS WAF, and when a reCAPTCHA, hCaptcha or GeeTest appears mid-flow the gateway calls the solving engine inline and carries on. Theirs returns UNSUPPORTED_CAPTCHA for a captcha embedded in the page, so that path needs a second vendor. This is the largest single difference between the two.
  • Credits expire. Their own FAQ states that credits not used inside the validity period are cleared, packages run 30 days, and top-ups are consumed oldest-first. Every other vendor here keeps your balance.
  • V2, the version that actually passes the JS challenge and Turnstile, has no bundled proxy. You must supply sticky or time-limited IPs, so the real cost is credits plus bandwidth — which the headline of $0.35 per 1,000 verifications excludes.
  • A flat 30 requests/second ceiling on every plan, including the $1,056 tier. Their FAQ says so directly.
  • Their FAQ states that Selenium and Puppeteer are not supported, because no browser is involved anywhere in the path. A browser-driven pipeline cannot use this at all.
  • The V2 session lock produces real concurrency bugs that they document themselves: CHALLENGE_LOCK_OCCUPIED when two threads share a part, CHALLENGE_LOCK_TIMEOUT under the wait strategy. You end up building a part-allocation pool, capped at 1,000 parts.
  • Their FAQ tells mainland China users that the proxies cannot be reached directly and that they should deploy on an overseas server or route through a TUN-mode global proxy. For a product whose core market is Chinese developers, that is friction they state themselves.
  • There is almost no independent review footprint — no Trustpilot, no G2, and search results dominated by their own marketing and tutorials. Reliability claims cannot be verified from outside, in either direction.

[ 02 ]Side by side

Side by side

Side by side
穿云API (Cloudbypass)NexCaptcha
Published pricingMonthly credit packages, $49 to $1,056, 30-day validity. V2 needs proxy bandwidth on top.One rate card for both lines, per 1,000 successful requests: Cloudflare Challenge $4.49, Turnstile $2.18, DataDome $2.18. 33 types published, balance does not expire.
Published latencyNot published. You set x-cb-timeout yourself, anywhere from 5 to 3,600 seconds.p50 and p95 per type. Cloudflare Challenge p50 8.2s, p95 19.5s; Turnstile p50 3.1s, p95 7.4s.
Published success rateNot published. You read the x-cb-status header on each request.Cloudflare Challenge 97.6%, Turnstile 99.8%, DataDome 97.2%, published per type.
What counts as a solveAn x-cb-status: ok response header, which is also what triggers billing.For the Automation API, the target's own response coming back. For the solving API, the target site accepting the token.
Failed-solve billingFailures cost nothing, but a passed challenge keeps its 2 credits if the response then errors.Failures are not billed. Rejected and timed-out ones are refunded within the hour, including a passed challenge whose response then errors.
API compatibilityHeader-driven HTTP forwarding. No task object, no taskId, no token is ever returned.The Automation API is the same header-driven forwarding, x-cb-* renamed to x-nc-*. createTask / getTaskResult when you want the token.
Support responseChinese documentation and Chinese-language support, with no published response target.24/7 from engineers. Median first response 7 minutes on Telegram.

[ 03 ]The code change

The code change

穿云API is request forwarding. There is no createTask, no taskId and no token: you repoint your original HTTP request at api.cloudbypass.com with the path, query, method and body intact, and move the real target into headers — x-cb-apikey for auth, x-cb-host for the target hostname, plus x-cb-fp, x-cb-proxy and x-cb-part. What comes back is the target's own response, and the x-cb-status: ok header is both the success signal and the billing trigger. Our Automation API is the same shape: the request goes to a gateway, the target sits in headers, and you get the target page back. The headers map one to one — x-cb-apikey to x-nc-key, x-cb-host to x-nc-host, x-cb-fp to x-nc-fingerprint, x-cb-proxy to x-nc-proxy, x-cb-part to x-nc-session. The names differ, so this is a thin header rename rather than a base-URL swap. If you want a token instead of a page, the Captcha Solving API is the other line: createTask / getTaskResult returns g-recaptcha-response, cf-turnstile-response or cf_clearance and you submit it yourself. Both lines run on the same worker pool and the same rate card, so the interface you pick does not change the price.

Before
const res = await fetch("https://api.cloudbypass.com" + path, {
headers: {
"x-cb-apikey": KEY,
"x-cb-host": "target.example",
"x-cb-fp": fingerprint,
"x-cb-proxy": stickyProxy,
"x-cb-part": String(session),
},
});
// x-cb-status: ok means it worked, and cost 3 credits
const html = await res.text();
After
const res = await fetch("https://gateway.nexcaptcha.net" + path, {
headers: {
"x-nc-key": KEY,
"x-nc-host": "target.example",
"x-nc-fingerprint": fingerprint,
"x-nc-proxy": stickyProxy,
"x-nc-session": String(session),
},
});
// same page back, billed once at the rate for the challenge actually hit
const html = await res.text();

How to migrate

  1. 01Decide first whether you want the page or a token. A request you were sending to api.cloudbypass.com wants the page, and that is the Automation API. If you were only using x-cb-sitekey to obtain a Turnstile token, the Captcha Solving API's TurnstileTaskProxyless is less work: no proxy, no session partition, token returned directly.
  2. 02Change the base URL from https://api.cloudbypass.com to https://gateway.nexcaptcha.net. The path, query string, method and body do not move.
  3. 03Rename the headers: x-cb-apikey to x-nc-key, x-cb-host to x-nc-host, x-cb-fp to x-nc-fingerprint, x-cb-proxy to x-nc-proxy, x-cb-part to x-nc-session. x-cb-version has no counterpart — the gateway routes on whatever shield the target actually presents.
  4. 04Delete the part-allocation pool and the CHALLENGE_LOCK_OCCUPIED / CHALLENGE_LOCK_TIMEOUT retry logic with it. x-nc-session is a session partition, not a mutex, so concurrent requests on one session do not evict each other and there is no 1,000-part ceiling to allocate around.
  5. 05Change the success check: instead of reading x-cb-status: ok, you are reading the target's own response, so your original status handling applies again. Map the error codes once — UNSUPPORTED_CAPTCHA largely stops appearing, because a reCAPTCHA, hCaptcha or GeeTest embedded mid-flow is solved inline. Failed requests are not billed.

[ 04 ]Questions about this one

Questions about this one

Yes. The Automation API is the same shape: the request goes to a gateway, the target host sits in a header, and the target page comes back. No task object, no polling. Two things change — the base URL becomes https://gateway.nexcaptcha.net, and five headers are renamed: x-cb-apikey to x-nc-key, x-cb-host to x-nc-host, x-cb-fp to x-nc-fingerprint, x-cb-proxy to x-nc-proxy, x-cb-part to x-nc-session. Because the names differ this is a small shim rather than a base-URL swap, but the request body and your response handling do not move. The safe way to do it is to pick one target, split the same batch of URLs between the two gateways, and compare pass rate and end-to-end time before you cut over.

They do Cloudflare, Turnstile and Incapsula. When a crawl hits reCAPTCHA, hCaptcha, GeeTest, DataDome, Akamai, Kasada, PerimeterX or AWS WAF, you get UNSUPPORTED_CAPTCHA and need a second vendor alongside them. Here it is one vendor: the Automation API's gateway can call the solving engine inline, so a reCAPTCHA, hCaptcha or GeeTest that appears mid-flow is solved in the chain and the request continues. If you would rather hold the token and submit it yourself, the Captcha Solving API covers 33 types. Either way it is the same rate card, priced by the challenge actually encountered, so the convenient interface does not cost more.

They do not transfer, and their own FAQ says credits left unused at the end of the validity period are cleared. The safe pattern is to switch near the end of a package: run the remaining credits down, stop renewing, and traffic-split during that window. There is no package to pre-buy here and nothing to expire.

For the Cloudflare path, no. Derived from their own credit rules at 3 credits per challenged request, their $259-and-above packages work out near $0.35 per 1,000 and the entry package near $1.84, against our $4.49 per 1,000 — assuming you burn the credits inside 30 days and counting the proxy bandwidth V2 requires separately. If you were only using x-cb-sitekey for Turnstile, switching is both simpler and cheaper than it looks: $2.18 per 1,000, no proxy, no session partition. The structural differences are throughput and billing terms: their FAQ caps every plan at 30 requests/second including the $1,056 tier, while the default key here is 50,000 requests per minute; failures are not billed, rejections are refunded, and the balance does not expire. The Automation API and the solving API bill from the same table, so the convenient interface does not cost extra.

Solve your first thousand on us.

Create a key, paste it into the sample above, and watch a real token come back. No card, no sales call.

Get your API keyTalk to an engineer