AWS WAF Solver — aws-waf-token Cookie per URL

One aws-waf-token session cookie per URL for pages protected by AWS WAF, plus the fetched page. Paste the token into your own HTTP client, browser or pipeline and keep calling the site without solving the challenge yourself.

• One dataset row per URL: the aws-waf-token cookie value, a ready-to-send Cookie header, the credential domain and expiry, and the page body fetched with the token.
• Paste cookieHeader straight into a Cookie: header — no extra parsing.
• A token issued through one outbound connection replays from another; tokenBinds reports what the token is bound to when the target publishes it.
• Pay only for rows you receive: $0.55 per 1,000 rows on the Free plan plus a small start fee.

What does AWS WAF Solver do?

AWS WAF Solver accepts a list of public page URLs that sit behind an AWS WAF edge challenge. For each URL it solves the challenge, obtains the session cookie (the aws-waf-token), fetches the page with that cookie and writes one dataset row containing the token and the page.

• Token and page (default): every URL in urls produces one row with awsWafToken, cookieHeader, the credential descriptor and body (the fetched page).
• One row per URL: maxResults caps how many URLs are processed in one run.

What data can you extract from AWS WAF Solver?

How to use AWS WAF Solver

1. Open AWS WAF Solver in Apify Console (a free Apify account is enough to try it).
2. Fill urls with one or more page URLs protected by AWS WAF.
3. Leave maxResults small, for example 3, for your first run.
4. Click Start and wait for the run to finish.
5. Read awsWafToken or cookieHeader from each row and send it as the aws-waf-token cookie on your next requests to that domain.

An empty input runs the sample values from the input form, limited to at most 10 rows, so you can see the output format before spending anything.

What to fill in

{
  "urls": ["https://www.example.com/"],
  "maxResults": 3
}

• maxResults is the most rows for the whole run, one per URL (maximum 70).
• Unknown fields are ignored; a malformed urls or a non-http(s) address fails the run before any row is charged.
• The INPUT_ECHO record in the run's key-value store shows what the run understood.

Output example

{
  "rowType": "page",
  "entityId": "https://www.example.com/",
  "url": "https://www.example.com/",
  "statusCode": 200,
  "body": "<!doctype html><html>…</html>",
  "bodyLen": 209553,
  "awsWafToken": "AQAAAH…",
  "cookieHeader": "aws-waf-token=AQAAAH…",
  "credential": {
    "name": "aws-waf-token",
    "domain": "www.example.com",
    "value": "AQAAAH…",
    "cookieHeader": "aws-waf-token=AQAAAH…",
    "ttlSeconds": 43200,
    "issuedAt": "2026-10-27T12:00:00Z",
    "expiresAt": "2026-10-27T24:00:00Z"
  },
  "tokenIssued": true,
  "elapsedMs": 2750
}

Export the dataset as JSON, CSV, Excel, XML, RSS or an HTML table. To use the token, send cookieHeader as the Cookie request header (or set the aws-waf-token cookie) on requests to credential.domain while credential.expiresAt has not passed.

Why use this AWS WAF solver?

• Pay per row. You pay for rows written to the dataset, not for URLs tried.
• Partial results are kept. A stopped or timed-out run still delivers and bills only the rows already collected.
• Clear errors. A row that fails carries a reason in error instead of a silent empty result.
• Several URLs per run. Pass a list and get one row each.
• No setup. You do not need proxies, cookies or an account with the target site.

How much does it cost to use AWS WAF Solver?

The Actor uses pay-per-event pricing: a $0.005 start fee per run and a price per row delivered. Platform usage is included in these prices.

• maxResults applies to the whole run, one row per URL. Default 3; the maximum is 70.
• Runs on the free Apify plan stop at 200 rows.
• The run never costs more than the Maximum cost per run you set in the run options (maxTotalChargeUsd in the API).
• The Apify Free plan includes $5.00 in monthly usage credit (about 9,090 rows at $0.00055 per row across Free-plan runs capped at 200 rows per run).

Example: 20 URLs → 20 rows → 20 × $0.00055 + $0.005 = $0.016 on the Free plan.

Use with AI agents and the API

Apify MCP server (Claude, ChatGPT, Cursor, VS Code)

Add this Actor as a tool in any MCP client that supports remote servers:

https://mcp.apify.com?tools=lentic_clockss/aws-waf-solver

Sign in with Apify when the client asks (OAuth), or send the header Authorization: Bearer <YOUR_APIFY_TOKEN>. The tool starts a run and returns the run and dataset IDs; the agent then reads the rows with get-dataset-items. Clients without remote MCP support can run npx @apify/actors-mcp-server --tools lentic_clockss/aws-waf-solver with the APIFY_TOKEN environment variable.

Example prompt: "Get an AWS WAF token for https://www.example.com/."

• Agent execution note: Set maxResults between 5 and 20 on exploratory tool calls to keep responses compact, and read RUN_SUMMARY and INPUT_ECHO from the default key-value store to inspect normalized inputs and delivered row counts.

Apify API

import requests
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("lentic_clockss/aws-waf-solver").call(
    run_input={"urls": ["https://www.example.com/"], "maxResults": 3}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["cookieHeader"])
    resp = requests.get(item["url"], headers={"Cookie": item["cookieHeader"]}, timeout=30)
    print(resp.status_code, len(resp.text))

Or over HTTP: POST https://api.apify.com/v2/acts/lentic_clockss~aws-waf-solver/runs with the input as the JSON body and your token in the Authorization: Bearer header, then GET https://api.apify.com/v2/datasets/<datasetId>/items?format=json.

Integrations

Connect the results to Google Sheets, Make, Zapier, n8n, Slack, Airtable or your own webhook from the Integrations tab of the Actor, or schedule regular runs with Apify Schedules.

FAQ

How do I use the token?

Send cookieHeader as the Cookie header on requests to credential.domain, or set a cookie named aws-waf-token with credential.value. The token stays valid until credential.expiresAt.

Is the token bound to one address?

The token is issued through one outbound connection but is not locked to its address; it replays from other connections. tokenBinds reports which caller attributes the token is bound to when the target publishes that information.

Why did a row have no awsWafToken?

The page arrived without a challenge (tokenIssued is false, credentialNeeded is false) or the issue step failed; such a row still carries statusCode, body when the page was fetched, and error when it was not.

Why did my run end as ABORTED?

A run ends ABORTED when the run timeout you set is shorter than the time the URLs needed, or when the run's charge limit was reached. Rows already collected are still delivered and billed.

How many results can I get?

One row per URL in urls, at most maxResults (maximum 70) per run. Runs on the free Apify plan stop at 200 rows.

Is it legal to use this Actor?

You are responsible for complying with the target site's terms and with data-protection law. Public pages only; personal data needs a lawful basis.

Limitations

• Only public pages that answer an AWS WAF edge challenge are supported; other kinds of site protection are out of scope.
• The cookie is issued for the domain in the URL and does not transfer to a different site.
• body is truncated at 200,000 characters per row.

Related solvers and scrapers

More developer and data tools from the same publisher:

• akamai Session solver
• Cloudflare solver
• DataDome Scraper
• Imperva Credential Scraper
• Stealth Web Scraper
• Phone Number Validator
• GitHub Scraper
• Polymarket Scraper

Browse all of our scrapers at apify.com/lentic_clockss.

Support

Found a problem or need another field? Open an issue in the Issues tab of this Actor's page and include the run ID and the input you used.