# AWS WAF Solver — aws-waf-token Cookie per URL (`lentic_clockss/aws-waf-solver`) Actor

Get an aws-waf-token session cookie per URL behind an AWS WAF edge challenge, plus the fetched page. Each row carries the token value, a ready-to-send Cookie header, domain, expiry and the page body.

- **URL**: https://apify.com/lentic_clockss/aws-waf-solver.md
- **Developed by:** [kane liu](https://apify.com/lentic_clockss) (community)
- **Categories:** Developer tools, Automation, MCP servers
- **Features:** Limited permissions
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 1 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.55 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**One `aws-waf-token` session cookie per URL for pages protected by AWS WAF, plus the fetched page. Paste the token into your own HTTP client, browser or pipeline and keep calling the site without solving the challenge yourself.**

- One dataset row per URL: the `aws-waf-token` cookie value, a ready-to-send `Cookie` header, the credential domain and expiry, and the page body fetched with the token.
- Paste `cookieHeader` straight into a `Cookie:` header — no extra parsing.
- A token issued through one outbound connection replays from another; `tokenBinds` reports what the token is bound to when the target publishes it.
- Pay only for rows you receive: $0.55 per 1,000 rows on the Free plan plus a small start fee.

### What does AWS WAF Solver do?

AWS WAF Solver accepts a list of public page URLs that sit behind an AWS WAF edge challenge. For each URL it solves the challenge, obtains the session cookie (the `aws-waf-token`), fetches the page with that cookie and writes one dataset row containing the token and the page.

- **Token and page (default)**: every URL in `urls` produces one row with `awsWafToken`, `cookieHeader`, the `credential` descriptor and `body` (the fetched page).
- **One row per URL**: `maxResults` caps how many URLs are processed in one run.

### What data can you extract from AWS WAF Solver?

| Field | Description | Example |
| --- | --- | --- |
| `url` | The input URL | `https://www.example.com/` |
| `statusCode` | HTTP status of the fetch after the cookie was applied | `200` |
| `body` | Page HTML fetched with the cookie | `<!doctype html>…` |
| `bodyLen` | Byte length of the page before text truncation | `209553` |
| `awsWafToken` | The `aws-waf-token` cookie value | `AQAAAH…` |
| `cookieHeader` | `aws-waf-token=<value>`, ready to send as a `Cookie` header | `aws-waf-token=AQAAAH…` |
| `credential` | Session credential descriptor object | see Output example |
| `credential.name` | Cookie name | `aws-waf-token` |
| `credential.domain` | Domain the cookie is valid for | `www.example.com` |
| `credential.value` | Same value as `awsWafToken` | `AQAAAH…` |
| `credential.ttlSeconds` | Cookie lifetime hint in seconds | `43200` |
| `credential.issuedAt` | When the cookie was issued (UTC) | `2026-10-27T12:00:00Z` |
| `credential.expiresAt` | `issuedAt + ttlSeconds` (UTC) | `2026-10-27T24:00:00Z` |
| `tokenIssued` | `true` when a token was issued for this row | `true` |
| `tokenBinds` | Which caller attributes the token is bound to | `{"secFetch":"applied"}` |
| `elapsedMs` | How long this URL took | `2750` |
| `rowType` | Always `page` | `page` |

### How to use AWS WAF Solver

1. Open [AWS WAF Solver](https://apify.com/lentic_clockss/aws-waf-solver) in Apify Console (a free Apify account is enough to try it).
2. Fill `urls` with one or more page URLs protected by AWS WAF.
3. Leave `maxResults` small, for example 3, for your first run.
4. Click **Start** and wait for the run to finish.
5. Read `awsWafToken` or `cookieHeader` from each row and send it as the `aws-waf-token` cookie on your next requests to that domain.

An empty input runs the sample values from the input form, limited to at most 10 rows, so you can see the output format before spending anything.

### What to fill in

| Field | What to enter | Default |
| --- | --- | --- |
| `urls` | One or more public page URLs behind AWS WAF | required |
| `maxResults` | Most rows this run delivers and charges, one per URL | `3` |
| `country` | Two-letter country code for the outbound connection | empty |
| `proxyGroup` | Outbound connection group name | empty |

```json
{
  "urls": ["https://www.example.com/"],
  "maxResults": 3
}
```

- `maxResults` is the most rows for the whole run, one per URL (maximum 70).
- Unknown fields are ignored; a malformed `urls` or a non-http(s) address fails the run before any row is charged.
- The `INPUT_ECHO` record in the run's key-value store shows what the run understood.

### Output example

```json
{
  "rowType": "page",
  "entityId": "https://www.example.com/",
  "url": "https://www.example.com/",
  "statusCode": 200,
  "body": "<!doctype html><html>…</html>",
  "bodyLen": 209553,
  "awsWafToken": "AQAAAH…",
  "cookieHeader": "aws-waf-token=AQAAAH…",
  "credential": {
    "name": "aws-waf-token",
    "domain": "www.example.com",
    "value": "AQAAAH…",
    "cookieHeader": "aws-waf-token=AQAAAH…",
    "ttlSeconds": 43200,
    "issuedAt": "2026-10-27T12:00:00Z",
    "expiresAt": "2026-10-27T24:00:00Z"
  },
  "tokenIssued": true,
  "elapsedMs": 2750
}
```

Export the dataset as JSON, CSV, Excel, XML, RSS or an HTML table. To use the token, send `cookieHeader` as the `Cookie` request header (or set the `aws-waf-token` cookie) on requests to `credential.domain` while `credential.expiresAt` has not passed.

### Why use this AWS WAF solver?

- **Pay per row.** You pay for rows written to the dataset, not for URLs tried.
- **Partial results are kept.** A stopped or timed-out run still delivers and bills only the rows already collected.
- **Clear errors.** A row that fails carries a reason in `error` instead of a silent empty result.
- **Several URLs per run.** Pass a list and get one row each.
- **No setup.** You do not need proxies, cookies or an account with the target site.

### How much does it cost to use AWS WAF Solver?

The Actor uses pay-per-event pricing: a $0.005 start fee per run and a price per row delivered. Platform usage is included in these prices.

| Apify plan | Price per row | Price per 1,000 rows |
| --- | --- | --- |
| Free | $0.00055 | $0.55 |
| Starter | $0.00055 | $0.55 |
| Scale | $0.00055 | $0.55 |
| Business | $0.00055 | $0.55 |
| Platinum | $0.00055 | $0.55 |
| Diamond | $0.00055 | $0.55 |

- `maxResults` applies to the whole run, one row per URL. Default `3`; the maximum is `70`.
- Runs on the free Apify plan stop at 200 rows.
- The run never costs more than the **Maximum cost per run** you set in the run options (`maxTotalChargeUsd` in the API).
- The Apify Free plan includes **$5.00** in monthly usage credit (about **9,090 rows** at `$0.00055` per row across Free-plan runs capped at 200 rows per run).

Example: 20 URLs → 20 rows → `20 × $0.00055 + $0.005 = $0.016` on the Free plan.

### Use with AI agents and the API

#### Apify MCP server (Claude, ChatGPT, Cursor, VS Code)

Add this Actor as a tool in any MCP client that supports remote servers:

```
https://mcp.apify.com?tools=lentic_clockss/aws-waf-solver
```

Sign in with Apify when the client asks (OAuth), or send the header `Authorization: Bearer <YOUR_APIFY_TOKEN>`. The tool starts a run and returns the run and dataset IDs; the agent then reads the rows with `get-dataset-items`. Clients without remote MCP support can run `npx @apify/actors-mcp-server --tools lentic_clockss/aws-waf-solver` with the `APIFY_TOKEN` environment variable.

Example prompt: "Get an AWS WAF token for https://www.example.com/."

- **Agent execution note:** Set `maxResults` between `5` and `20` on exploratory tool calls to keep responses compact, and read `RUN_SUMMARY` and `INPUT_ECHO` from the default key-value store to inspect normalized inputs and delivered row counts.

#### Apify API

```python
import requests
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("lentic_clockss/aws-waf-solver").call(
    run_input={"urls": ["https://www.example.com/"], "maxResults": 3}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["cookieHeader"])
    resp = requests.get(item["url"], headers={"Cookie": item["cookieHeader"]}, timeout=30)
    print(resp.status_code, len(resp.text))
```

Or over HTTP: `POST https://api.apify.com/v2/acts/lentic_clockss~aws-waf-solver/runs` with the input as the JSON body and your token in the `Authorization: Bearer` header, then `GET https://api.apify.com/v2/datasets/<datasetId>/items?format=json`.

#### Integrations

Connect the results to Google Sheets, Make, Zapier, n8n, Slack, Airtable or your own webhook from the **Integrations** tab of the Actor, or schedule regular runs with Apify Schedules.

### FAQ

#### How do I use the token?

Send `cookieHeader` as the `Cookie` header on requests to `credential.domain`, or set a cookie named `aws-waf-token` with `credential.value`. The token stays valid until `credential.expiresAt`.

#### Is the token bound to one address?

The token is issued through one outbound connection but is not locked to its address; it replays from other connections. `tokenBinds` reports which caller attributes the token is bound to when the target publishes that information.

#### Why did a row have no `awsWafToken`?

The page arrived without a challenge (`tokenIssued` is `false`, `credentialNeeded` is `false`) or the issue step failed; such a row still carries `statusCode`, `body` when the page was fetched, and `error` when it was not.

#### Why did my run end as ABORTED?

A run ends ABORTED when the run timeout you set is shorter than the time the URLs needed, or when the run's charge limit was reached. Rows already collected are still delivered and billed.

#### How many results can I get?

One row per URL in `urls`, at most `maxResults` (maximum 70) per run. Runs on the free Apify plan stop at 200 rows.

#### Is it legal to use this Actor?

You are responsible for complying with the target site's terms and with data-protection law. Public pages only; personal data needs a lawful basis.

### Limitations

- Only public pages that answer an AWS WAF edge challenge are supported; other kinds of site protection are out of scope.
- The cookie is issued for the domain in the URL and does not transfer to a different site.
- `body` is truncated at 200,000 characters per row.

### Related solvers and scrapers

More developer and data tools from the same publisher:

- [akamai Session solver](https://apify.com/lentic_clockss/akamai-solver)
- [Cloudflare solver](https://apify.com/lentic_clockss/cf-clearance-solver)
- [DataDome Scraper](https://apify.com/lentic_clockss/datadome-solver)
- [Imperva Credential Scraper](https://apify.com/lentic_clockss/imperva-schema)
- [Stealth Web Scraper](https://apify.com/lentic_clockss/stealth-web-scraper)
- [Phone Number Validator](https://apify.com/lentic_clockss/phone-number-intelligence)
- [GitHub Scraper](https://apify.com/lentic_clockss/github-scraper)
- [Polymarket Scraper](https://apify.com/lentic_clockss/polymarket-scraper)

Browse all of our scrapers at [apify.com/lentic_clockss](https://apify.com/lentic_clockss).

### Support

Found a problem or need another field? Open an issue in the **Issues** tab of this Actor's page and include the run ID and the input you used.

# Actor input Schema

## `urls` (type: `array`):

Public page URLs behind AWS WAF. Each URL becomes one dataset row with the aws-waf-token and the fetched page.

## `maxResults` (type: `integer`):

Most rows (one per URL) to deliver and charge for this run.

## `country` (type: `string`):

Optional two-letter country code for the outbound connection (e.g. US, DE).

## `proxyGroup` (type: `string`):

Optional outbound connection group name. Leave empty for the default.

## Actor input object example

```json
{
  "urls": [
    "https://www.example.com/"
  ],
  "maxResults": 3
}
```

# Actor output Schema

## `rows` (type: `string`):

One row per URL with the aws-waf-token value, the cookieHeader, the credential descriptor and the page body.

## `runSummary` (type: `string`):

Run summary with row counts, the input as understood, and finish times.

## `inputEcho` (type: `string`):

Input values the run actually used after normalization.

## `errorSummary` (type: `string`):

Error information when the run fails.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://www.example.com/"
    ],
    "maxResults": 3
};

// Run the Actor and wait for it to finish
const run = await client.actor("lentic_clockss/aws-waf-solver").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": ["https://www.example.com/"],
    "maxResults": 3,
}

# Run the Actor and wait for it to finish
run = client.actor("lentic_clockss/aws-waf-solver").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://www.example.com/"
  ],
  "maxResults": 3
}' |
apify call lentic_clockss/aws-waf-solver --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,lentic_clockss/aws-waf-solver"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/3PBbpweDI3pnDBjeM/builds/izB7bbUDuhBGUslp1/openapi.json