Cloudflare Solver — cf_clearance & Turnstile Token

Get a Cloudflare cf_clearance session cookie on any public URL behind the "Just a moment…" challenge — and get a Turnstile challenge token when you name a sitekey. Paste the result into your own HTTP client, browser or pipeline and keep calling the site yourself.

Some public pages answer a request with a Cloudflare challenge instead of content — the browser is told to wait while an edge check runs. This Actor runs a real browser through that check for you and hands back two things you can reuse:

• A cf_clearance session cookie plus a ready-to-send Cookie header and the fetched page — for pages gated at the edge (the interstitial that must clear before content loads).
• A Turnstile challenge token — for pages that render a challenge widget inside a form (login, signup, checkout, contact) and only accept the submission after the widget passes. Give the page's sitekey and you get the token your backend posts to the site's siteverify endpoint.

One dataset row per URL. You don't run a browser, manage an exit, or decode the challenge — the Actor does all three.

What does Cloudflare Solver do?

Two products share one run, picked per input entry:

Session cookie (default — a bare URL) — for pages that hold content behind a Cloudflare edge challenge. Give a public URL and the Actor completes the check with a real browser, lands the cf_clearance + __cf_bm session cookie, then fetches the page with it. You get the cookie value, a ready-to-send Cookie header, the bound domain and expiry, and the page body. Replay it in your own requests and the site treats you as a session that already passed.

Turnstile challenge token (a {"url","sitekey"} entry) — for forms that embed a Turnstile challenge widget. Give the URL plus the widget's sitekey and the Actor drives a browser through the widget and returns the issued token: the 300-second, single-use string your backend posts to siteverify to clear the form gate.

• One row per URL in urls — a bare string yields the cookie product; an object with a sitekey yields the token product. Mix both in one run.
• maxResults caps how many URLs are processed (and billed) per run.
• Paste cookieHeader straight into a Cookie: header — no extra parsing.
• Rows that fail to land a token are not billed.

What data can you extract from Cloudflare Solver?

Field	Description	Example
url	The input URL	https://www.example.com/
statusCode	HTTP status of the fetch after the credential was applied	200
body	Page HTML fetched with the credential	<!doctype html>…
bodyLen	Byte length of the page before truncation	209553
cfClearance	The cf_clearance cookie value (cookie product)	cfclr…
cookieHeader	cf_clearance=<value>; __cf_bm=<value>, ready to send as a Cookie header	cf_clearance=…; __cf_bm=…
credential	Session credential descriptor object	see Output example
credential.name	Cookie name	cf_clearance
credential.domain	Domain the cookie is valid for	www.example.com
credential.value	Same value as cfClearance	cfclr…
credential.ttlSeconds	Cookie lifetime hint in seconds	1500
credential.issuedAt	When the cookie was issued (UTC)	2026-11-19T12:00:00Z
credential.expiresAt	issuedAt + ttlSeconds (UTC)	2026-11-19T12:25:00Z
tokenIssued	true when a credential was issued for this row	true
tokenBinds	Which caller attributes the credential is bound to	{"ip":"pinned","ua":"any"}
product	cfClearance (default) or widgetToken	widgetToken
widgetToken	Page-embedded challenge token, 300s single-use (token product)	0.Qm9…
widgetSitekey	Widget site key the token was issued for	0x4AAAAAAA…
tokenTtlSeconds	Token validity window in seconds	300
elapsedMs	How long this URL took	2750
rowType	Always page	page

How to use Cloudflare Solver

1. Open Cloudflare Solver in Apify Console (a free Apify account is enough to try it).
2. Fill urls with one or more public page URLs that sit behind an edge challenge.
3. Leave maxResults small, for example 3, for your first run.
4. Click Start and wait for the run to finish.
5. Read cfClearance or cookieHeader from each row and send it as the cf_clearance/__cf_bm cookies on your next requests to that domain — or read widgetToken from a sitekey row and post it to siteverify.

An empty input runs the sample values from the input form, limited to at most 10 rows, so you can see the output format before spending anything.

What to fill in

Field	What to enter	Default
urls	One or more public page URLs behind an edge challenge; an entry may be a bare URL string or {"url": "…", "sitekey": "…"} for the token product	required
maxResults	Most rows this run delivers and charges, one per URL	3
proxyUrl	Caller-supplied outbound proxy (your own residential pool or any provider). Leave empty to use the managed sticky outbound connection	empty
country	Two-letter country code for the managed sticky outbound connection; ignored when proxyUrl is set	empty
proxyGroup	Managed sticky outbound connection group name; ignored when proxyUrl is set	empty

{
  "urls": ["https://www.example.com/"],
  "maxResults": 3
}

Page-embedded challenge token (the sitekey product)

Some pages put the gate inside the page instead of in front of it — a login, signup, checkout or contact form that renders a challenge widget and only accepts the submission after your backend proves the widget passed. That proof is a token you post to the site's siteverify endpoint.

Give an entry a sitekey and this Actor returns that token: it drives a real browser through the widget, collects the issued response and writes a row. Use it when you automate a form post and the server rejects the submission without a fresh token — your backend posts {secret, response: <token>, remoteip} to siteverify and proceeds.

{
  "urls": [
    {"url": "https://www.example.com/login", "sitekey": "0x4AAAAAAA…"},
    {"url": "https://www.example.com/signup", "sitekey": "0x4AAAAAAA…"}
  ],
  "maxResults": 3
}

Each token row carries product: "widgetToken", widgetToken, widgetSitekey, tokenTtlSeconds: 300 and tokenBinds. The token is bound to the outbound address, user-agent and sitekey it was issued against and is single-use — it cannot be replayed from a different connection or reused after 300 seconds. Rows that fail to land a token are not billed.

Your proxy or ours

• Caller-supplied (proxyUrl): any proxy you already pay for — your own residential pool or a provider you hold. The Actor uses it as the issuing and replay connection, so the credential lands on an exit you already trust; you own its reputation and binding.

• Managed sticky (default, or country/proxyGroup to pick an outbound connection): we hold a sticky residential exit bound to the credential's binds, so the issued cookie/token replays from the same IP it was issued on — you don't choose or rotate it.

• maxResults is the most rows for the whole run, one per URL (maximum 70).

• Unknown fields are ignored; a malformed urls or a non-http(s) address fails the run before any row is charged.

• The INPUT_ECHO record in the run's key-value store shows what the run understood.

Output example

{
  "rowType": "page",
  "entityId": "https://www.example.com/",
  "url": "https://www.example.com/",
  "statusCode": 200,
  "body": "<!doctype html><html>…</html>",
  "bodyLen": 209553,
  "cfClearance": "cfclr…",
  "cookieHeader": "cf_clearance=cfclr…; __cf_bm=bm-abc…",
  "credential": {
    "name": "cf_clearance",
    "domain": "www.example.com",
    "value": "cfclr…",
    "cookieHeader": "cf_clearance=cfclr…; __cf_bm=bm-abc…",
    "ttlSeconds": 1500,
    "issuedAt": "2026-11-19T12:00:00Z",
    "expiresAt": "2026-11-19T12:25:00Z",
    "extra_cookies": [{"name": "__cf_bm", "value": "bm-abc…"}]
  },
  "tokenIssued": true,
  "elapsedMs": 2750
}

Export the dataset as JSON, CSV, Excel, XML, RSS or an HTML table. To use the credential, send cookieHeader as the Cookie request header (or set the cf_clearance/__cf_bm cookies) on requests to credential.domain while credential.expiresAt has not passed.

Why use this Cloudflare solver?

• Pay per row. You pay for rows written to the dataset, not for URLs tried.
• Two credential products in one run. A page-facing cf_clearance cookie or a form-facing siteverify token — pick per entry, mix freely.
• Binding is explicit. tokenBinds/credential.binds tell you whether the credential replays from another exit or is pinned to the issuing address/user-agent — no guesswork on reuse.
• Partial results are kept. A stopped or timed-out run still delivers and bills only the rows already collected.
• Clear errors. A row that fails carries a reason in error instead of a silent empty result.
• Several URLs per run. Pass a list and get one row each.
• No setup. You do not need proxies, cookies or an account with the target site.

How much does it cost to use Cloudflare Solver?

The Actor uses pay-per-event pricing: a $0.005 start fee per run and a price per row delivered. Platform usage is included in these prices.

Apify plan	Price per row	Price per 1,000 rows
Free	$0.00055	$0.55
Starter	$0.00055	$0.55
Scale	$0.00055	$0.55
Business	$0.00055	$0.55
Platinum	$0.00055	$0.55
Diamond	$0.00055	$0.55

• maxResults applies to the whole run, one row per URL. Default 3; the maximum is 70.
• Runs on the free Apify plan stop at 200 rows.
• The run never costs more than the Maximum cost per run you set in the run options (maxTotalChargeUsd in the API).
• A token row that does not land a token is not billed — you pay only for issued credentials.
• The Apify Free plan includes $5.00 in monthly usage credit (about 9,090 rows at $0.00055 per row across Free-plan runs capped at 200 rows per run).

Example: 20 URLs → 20 rows → 20 × $0.00055 + $0.005 = $0.016 on the Free plan.

Use with AI agents and the API

Apify MCP server (Claude, ChatGPT, Cursor, VS Code)

Add this Actor as a tool in any MCP client that supports remote servers:

https://mcp.apify.com?tools=lentic_clockss/cf-clearance-solver

Sign in with Apify when the client asks (OAuth), or send the header Authorization: Bearer <YOUR_APIFY_TOKEN>. The tool starts a run and returns the run and dataset IDs; the agent then reads the rows with get-dataset-items. Clients without remote MCP support can run npx @apify/actors-mcp-server --tools lentic_clockss/cf-clearance-solver with the APIFY_TOKEN environment variable.

Example prompt: "Get a cf_clearance cookie for https://www.example.com/."

• Agent execution note: Set maxResults between 5 and 20 on exploratory tool calls to keep responses compact, and read RUN_SUMMARY and INPUT_ECHO from the default key-value store to inspect normalized inputs and delivered row counts.

Apify API

import requests
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("lentic_clockss/cf-clearance-solver").call(
    run_input={"urls": ["https://www.example.com/"], "maxResults": 3}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["cookieHeader"])
    resp = requests.get(item["url"], headers={"Cookie": item["cookieHeader"]}, timeout=30)
    print(resp.status_code, len(resp.text))

Or over HTTP: POST https://api.apify.com/v2/acts/lentic_clockss~cf-clearance-solver/runs with the input as the JSON body and your token in the Authorization: Bearer header, then GET https://api.apify.com/v2/datasets/<datasetId>/items?format=json.

Integrations

Connect the results to Google Sheets, Make, Zapier, n8n, Slack, Airtable or your own webhook from the Integrations tab of the Actor, or schedule regular runs with Apify Schedules.

FAQ

How do I use the credential?

Send cookieHeader as the Cookie header on requests to credential.domain, or set cookies named cf_clearance and __cf_bm with the values in credential.extra_cookies. The credential stays valid until credential.expiresAt.

Is the credential bound to one address?

On most targets cf_clearance is bound to the address and user-agent it was issued for; tokenBinds reports which axes are declared (ip, ua, tls, session, surface). Replay it from the same connection profile and user-agent the credential was issued under when the binds pin them.

Why did a row have no cfClearance?

The page arrived without a challenge (tokenIssued is false, credentialNeeded is false), the edge refused the request (error names the code), or the issue step failed; such a row still carries statusCode, body when the page was fetched, and error when it was not.

Why did my run end as ABORTED?

A run ends ABORTED when the run timeout you set is shorter than the time the URLs needed, or when the run's charge limit was reached. Rows already collected are still delivered and billed.

How many results can I get?

One row per URL in urls, at most maxResults (maximum 70) per run. Runs on the free Apify plan stop at 200 rows.

Which parts of the credential are bound, and how do I replay it?

Each issued row carries two descriptors that tell you what the edge pinned:

• tokenBinds (top level) and credential.binds report the declared axes — ip, ua, tls, session, surface. A value of pinned/sameExit on ip means the cf_clearance only validates from the outbound connection it was issued on; ua/tls mean the same user-agent and TLS client profile must be sent on replay.
• credential.ttlSeconds (echoed as top-level ttlHintS) is the edge's own validity hint (about 25 minutes for cf_clearance); the companion __cf_bm in credential.extra_cookies rotates faster, so keep the full cookieHeader rather than only cf_clearance.

When binds pins ip, replay from the same country/proxyGroup you issued under and reuse cookieHeader verbatim; a credential issued on one exit will 403 from another even if it has not expired. When no axis is pinned, the cookie replays from other connections until credential.expiresAt.

Is it legal to use this Actor?

You are responsible for complying with the target site's terms and with data-protection law. Public pages only; personal data needs a lawful basis.

Limitations

• Only public pages that answer an edge challenge are supported; other kinds of site protection are out of scope.
• The cookie is issued for the domain in the URL and does not transfer to a different site.
• body is truncated at 200,000 characters per row.

Related solvers and scrapers

More developer and data tools from the same publisher:

• akamai Session solver
• AWS WAF Scraper
• DataDome Scraper
• Imperva Credential Scraper
• Stealth Web Scraper
• Phone Number Validator
• GitHub Scraper
• Polymarket Scraper

Browse all of our scrapers at apify.com/lentic_clockss.

Support

Found a problem or need another field? Open an issue in the Issues tab of this Actor's page and include the run ID and the input you used.