# Cloudflare Solver — cf_clearance & Turnstile Token (`lentic_clockss/cf-clearance-solver`) Actor

Get a Cloudflare cf_clearance session cookie per URL behind an edge challenge, or a Turnstile siteverify token when you name a sitekey. Each row carries the cookie value, a ready-to-send Cookie header, domain, expiry and the page body.

- **URL**: https://apify.com/lentic_clockss/cf-clearance-solver.md
- **Developed by:** [kane liu](https://apify.com/lentic_clockss) (community)
- **Categories:** Developer tools, Automation, MCP servers
- **Features:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.55 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**Get a Cloudflare `cf_clearance` session cookie on any public URL behind the "Just a moment…" challenge — and get a Turnstile challenge token when you name a sitekey. Paste the result into your own HTTP client, browser or pipeline and keep calling the site yourself.**

Some public pages answer a request with a Cloudflare challenge instead of content — the browser is told to wait while an edge check runs. This Actor runs a real browser through that check for you and hands back two things you can reuse:

- A **`cf_clearance` session cookie** plus a ready-to-send `Cookie` header and the fetched page — for pages gated at the edge (the interstitial that must clear before content loads).
- A **Turnstile challenge token** — for pages that render a challenge widget inside a form (login, signup, checkout, contact) and only accept the submission after the widget passes. Give the page's `sitekey` and you get the token your backend posts to the site's `siteverify` endpoint.

One dataset row per URL. You don't run a browser, manage an exit, or decode the challenge — the Actor does all three.

### What does Cloudflare Solver do?

Two products share one run, picked per input entry:

**Session cookie (default — a bare URL)** — for pages that hold content behind a Cloudflare edge challenge. Give a public URL and the Actor completes the check with a real browser, lands the `cf_clearance` + `__cf_bm` session cookie, then fetches the page with it. You get the cookie value, a ready-to-send `Cookie` header, the bound domain and expiry, and the page body. Replay it in your own requests and the site treats you as a session that already passed.

**Turnstile challenge token (a `{"url","sitekey"}` entry)** — for forms that embed a Turnstile challenge widget. Give the URL plus the widget's `sitekey` and the Actor drives a browser through the widget and returns the issued token: the 300-second, single-use string your backend posts to `siteverify` to clear the form gate.

- **One row per URL** in `urls` — a bare string yields the cookie product; an object with a `sitekey` yields the token product. Mix both in one run.
- **`maxResults`** caps how many URLs are processed (and billed) per run.
- **Paste `cookieHeader` straight into a `Cookie:` header** — no extra parsing.
- Rows that fail to land a token are **not billed**.

### What data can you extract from Cloudflare Solver?

| Field | Description | Example |
| --- | --- | --- |
| `url` | The input URL | `https://www.example.com/` |
| `statusCode` | HTTP status of the fetch after the credential was applied | `200` |
| `body` | Page HTML fetched with the credential | `<!doctype html>…` |
| `bodyLen` | Byte length of the page before truncation | `209553` |
| `cfClearance` | The `cf_clearance` cookie value (cookie product) | `cfclr…` |
| `cookieHeader` | `cf_clearance=<value>; __cf_bm=<value>`, ready to send as a `Cookie` header | `cf_clearance=…; __cf_bm=…` |
| `credential` | Session credential descriptor object | see Output example |
| `credential.name` | Cookie name | `cf_clearance` |
| `credential.domain` | Domain the cookie is valid for | `www.example.com` |
| `credential.value` | Same value as `cfClearance` | `cfclr…` |
| `credential.ttlSeconds` | Cookie lifetime hint in seconds | `1500` |
| `credential.issuedAt` | When the cookie was issued (UTC) | `2026-11-19T12:00:00Z` |
| `credential.expiresAt` | `issuedAt + ttlSeconds` (UTC) | `2026-11-19T12:25:00Z` |
| `tokenIssued` | `true` when a credential was issued for this row | `true` |
| `tokenBinds` | Which caller attributes the credential is bound to | `{"ip":"pinned","ua":"any"}` |
| `product` | `cfClearance` (default) or `widgetToken` | `widgetToken` |
| `widgetToken` | Page-embedded challenge token, 300s single-use (token product) | `0.Qm9…` |
| `widgetSitekey` | Widget site key the token was issued for | `0x4AAAAAAA…` |
| `tokenTtlSeconds` | Token validity window in seconds | `300` |
| `elapsedMs` | How long this URL took | `2750` |
| `rowType` | Always `page` | `page` |

### How to use Cloudflare Solver

1. Open [Cloudflare Solver](https://apify.com/lentic_clockss/cf-clearance-solver) in Apify Console (a free Apify account is enough to try it).
2. Fill `urls` with one or more public page URLs that sit behind an edge challenge.
3. Leave `maxResults` small, for example `3`, for your first run.
4. Click **Start** and wait for the run to finish.
5. Read `cfClearance` or `cookieHeader` from each row and send it as the `cf_clearance`/`__cf_bm` cookies on your next requests to that domain — or read `widgetToken` from a `sitekey` row and post it to `siteverify`.

An empty input runs the sample values from the input form, limited to at most 10 rows, so you can see the output format before spending anything.

### What to fill in

| Field | What to enter | Default |
| --- | --- | --- |
| `urls` | One or more public page URLs behind an edge challenge; an entry may be a bare URL string or `{"url": "…", "sitekey": "…"}` for the token product | required |
| `maxResults` | Most rows this run delivers and charges, one per URL | `3` |
| `proxyUrl` | Caller-supplied outbound proxy (your own residential pool or any provider). Leave empty to use the managed sticky outbound connection | empty |
| `country` | Two-letter country code for the managed sticky outbound connection; ignored when `proxyUrl` is set | empty |
| `proxyGroup` | Managed sticky outbound connection group name; ignored when `proxyUrl` is set | empty |

```json
{
  "urls": ["https://www.example.com/"],
  "maxResults": 3
}
```

#### Page-embedded challenge token (the `sitekey` product)

Some pages put the gate inside the page instead of in front of it — a login, signup, checkout or contact form that renders a challenge widget and only accepts the submission after your backend proves the widget passed. That proof is a token you post to the site's `siteverify` endpoint.

Give an entry a `sitekey` and this Actor returns that token: it drives a real browser through the widget, collects the issued response and writes a row. Use it when you automate a form post and the server rejects the submission without a fresh token — your backend posts `{secret, response: <token>, remoteip}` to `siteverify` and proceeds.

```json
{
  "urls": [
    {"url": "https://www.example.com/login", "sitekey": "0x4AAAAAAA…"},
    {"url": "https://www.example.com/signup", "sitekey": "0x4AAAAAAA…"}
  ],
  "maxResults": 3
}
```

Each token row carries `product: "widgetToken"`, `widgetToken`, `widgetSitekey`, `tokenTtlSeconds: 300` and `tokenBinds`. The token is bound to the outbound address, user-agent and `sitekey` it was issued against and is single-use — it cannot be replayed from a different connection or reused after 300 seconds. Rows that fail to land a token are not billed.

#### Your proxy or ours

- **Caller-supplied** (`proxyUrl`): any proxy you already pay for — your own residential pool or a provider you hold. The Actor uses it as the issuing and replay connection, so the credential lands on an exit you already trust; you own its reputation and binding.

- **Managed sticky** (default, or `country`/`proxyGroup` to pick an outbound connection): we hold a sticky residential exit bound to the credential's `binds`, so the issued cookie/token replays from the same IP it was issued on — you don't choose or rotate it.

- `maxResults` is the most rows for the whole run, one per URL (maximum 70).

- Unknown fields are ignored; a malformed `urls` or a non-http(s) address fails the run before any row is charged.

- The `INPUT_ECHO` record in the run's key-value store shows what the run understood.

### Output example

```json
{
  "rowType": "page",
  "entityId": "https://www.example.com/",
  "url": "https://www.example.com/",
  "statusCode": 200,
  "body": "<!doctype html><html>…</html>",
  "bodyLen": 209553,
  "cfClearance": "cfclr…",
  "cookieHeader": "cf_clearance=cfclr…; __cf_bm=bm-abc…",
  "credential": {
    "name": "cf_clearance",
    "domain": "www.example.com",
    "value": "cfclr…",
    "cookieHeader": "cf_clearance=cfclr…; __cf_bm=bm-abc…",
    "ttlSeconds": 1500,
    "issuedAt": "2026-11-19T12:00:00Z",
    "expiresAt": "2026-11-19T12:25:00Z",
    "extra_cookies": [{"name": "__cf_bm", "value": "bm-abc…"}]
  },
  "tokenIssued": true,
  "elapsedMs": 2750
}
```

Export the dataset as JSON, CSV, Excel, XML, RSS or an HTML table. To use the credential, send `cookieHeader` as the `Cookie` request header (or set the `cf_clearance`/`__cf_bm` cookies) on requests to `credential.domain` while `credential.expiresAt` has not passed.

### Why use this Cloudflare solver?

- **Pay per row.** You pay for rows written to the dataset, not for URLs tried.
- **Two credential products in one run.** A page-facing `cf_clearance` cookie or a form-facing `siteverify` token — pick per entry, mix freely.
- **Binding is explicit.** `tokenBinds`/`credential.binds` tell you whether the credential replays from another exit or is pinned to the issuing address/user-agent — no guesswork on reuse.
- **Partial results are kept.** A stopped or timed-out run still delivers and bills only the rows already collected.
- **Clear errors.** A row that fails carries a reason in `error` instead of a silent empty result.
- **Several URLs per run.** Pass a list and get one row each.
- **No setup.** You do not need proxies, cookies or an account with the target site.

### How much does it cost to use Cloudflare Solver?

The Actor uses pay-per-event pricing: a $0.005 start fee per run and a price per row delivered. Platform usage is included in these prices.

| Apify plan | Price per row | Price per 1,000 rows |
| --- | --- | --- |
| Free | $0.00055 | $0.55 |
| Starter | $0.00055 | $0.55 |
| Scale | $0.00055 | $0.55 |
| Business | $0.00055 | $0.55 |
| Platinum | $0.00055 | $0.55 |
| Diamond | $0.00055 | $0.55 |

- `maxResults` applies to the whole run, one row per URL. Default `3`; the maximum is `70`.
- Runs on the free Apify plan stop at 200 rows.
- The run never costs more than the **Maximum cost per run** you set in the run options (`maxTotalChargeUsd` in the API).
- A token row that does not land a token is **not billed** — you pay only for issued credentials.
- The Apify Free plan includes **$5.00** in monthly usage credit (about **9,090 rows** at `$0.00055` per row across Free-plan runs capped at 200 rows per run).

Example: 20 URLs → 20 rows → `20 × $0.00055 + $0.005 = $0.016` on the Free plan.

### Use with AI agents and the API

#### Apify MCP server (Claude, ChatGPT, Cursor, VS Code)

Add this Actor as a tool in any MCP client that supports remote servers:

```
https://mcp.apify.com?tools=lentic_clockss/cf-clearance-solver
```

Sign in with Apify when the client asks (OAuth), or send the header `Authorization: Bearer <YOUR_APIFY_TOKEN>`. The tool starts a run and returns the run and dataset IDs; the agent then reads the rows with `get-dataset-items`. Clients without remote MCP support can run `npx @apify/actors-mcp-server --tools lentic_clockss/cf-clearance-solver` with the `APIFY_TOKEN` environment variable.

Example prompt: "Get a cf_clearance cookie for https://www.example.com/."

- **Agent execution note:** Set `maxResults` between `5` and `20` on exploratory tool calls to keep responses compact, and read `RUN_SUMMARY` and `INPUT_ECHO` from the default key-value store to inspect normalized inputs and delivered row counts.

#### Apify API

```python
import requests
from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("lentic_clockss/cf-clearance-solver").call(
    run_input={"urls": ["https://www.example.com/"], "maxResults": 3}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["cookieHeader"])
    resp = requests.get(item["url"], headers={"Cookie": item["cookieHeader"]}, timeout=30)
    print(resp.status_code, len(resp.text))
```

Or over HTTP: `POST https://api.apify.com/v2/acts/lentic_clockss~cf-clearance-solver/runs` with the input as the JSON body and your token in the `Authorization: Bearer` header, then `GET https://api.apify.com/v2/datasets/<datasetId>/items?format=json`.

#### Integrations

Connect the results to Google Sheets, Make, Zapier, n8n, Slack, Airtable or your own webhook from the **Integrations** tab of the Actor, or schedule regular runs with Apify Schedules.

### FAQ

#### How do I use the credential?

Send `cookieHeader` as the `Cookie` header on requests to `credential.domain`, or set cookies named `cf_clearance` and `__cf_bm` with the values in `credential.extra_cookies`. The credential stays valid until `credential.expiresAt`.

#### Is the credential bound to one address?

On most targets `cf_clearance` is bound to the address and user-agent it was issued for; `tokenBinds` reports which axes are declared (`ip`, `ua`, `tls`, `session`, `surface`). Replay it from the same connection profile and user-agent the credential was issued under when the binds pin them.

#### Why did a row have no `cfClearance`?

The page arrived without a challenge (`tokenIssued` is `false`, `credentialNeeded` is `false`), the edge refused the request (`error` names the code), or the issue step failed; such a row still carries `statusCode`, `body` when the page was fetched, and `error` when it was not.

#### Why did my run end as ABORTED?

A run ends ABORTED when the run timeout you set is shorter than the time the URLs needed, or when the run's charge limit was reached. Rows already collected are still delivered and billed.

#### How many results can I get?

One row per URL in `urls`, at most `maxResults` (maximum 70) per run. Runs on the free Apify plan stop at 200 rows.

#### Which parts of the credential are bound, and how do I replay it?

Each issued row carries two descriptors that tell you what the edge pinned:

- `tokenBinds` (top level) and `credential.binds` report the declared axes — `ip`, `ua`, `tls`, `session`, `surface`. A value of `pinned`/`sameExit` on `ip` means the `cf_clearance` only validates from the outbound connection it was issued on; `ua`/`tls` mean the same user-agent and TLS client profile must be sent on replay.
- `credential.ttlSeconds` (echoed as top-level `ttlHintS`) is the edge's own validity hint (about 25 minutes for `cf_clearance`); the companion `__cf_bm` in `credential.extra_cookies` rotates faster, so keep the full `cookieHeader` rather than only `cf_clearance`.

When `binds` pins `ip`, replay from the same `country`/`proxyGroup` you issued under and reuse `cookieHeader` verbatim; a credential issued on one exit will 403 from another even if it has not expired. When no axis is pinned, the cookie replays from other connections until `credential.expiresAt`.

#### Is it legal to use this Actor?

You are responsible for complying with the target site's terms and with data-protection law. Public pages only; personal data needs a lawful basis.

### Limitations

- Only public pages that answer an edge challenge are supported; other kinds of site protection are out of scope.
- The cookie is issued for the domain in the URL and does not transfer to a different site.
- `body` is truncated at 200,000 characters per row.

### Related solvers and scrapers

More developer and data tools from the same publisher:

- [akamai Session solver](https://apify.com/lentic_clockss/akamai-solver)
- [AWS WAF Scraper](https://apify.com/lentic_clockss/aws-waf-solver)
- [DataDome Scraper](https://apify.com/lentic_clockss/datadome-solver)
- [Imperva Credential Scraper](https://apify.com/lentic_clockss/imperva-schema)
- [Stealth Web Scraper](https://apify.com/lentic_clockss/stealth-web-scraper)
- [Phone Number Validator](https://apify.com/lentic_clockss/phone-number-intelligence)
- [GitHub Scraper](https://apify.com/lentic_clockss/github-scraper)
- [Polymarket Scraper](https://apify.com/lentic_clockss/polymarket-scraper)

Browse all of our scrapers at [apify.com/lentic_clockss](https://apify.com/lentic_clockss).

### Support

Found a problem or need another field? Open an issue in the **Issues** tab of this Actor's page and include the run ID and the input you used.

# Actor input Schema

## `urls` (type: `array`):

Public page URLs behind an edge challenge. Each entry becomes one dataset row. A bare string yields the cf_clearance cookie and the fetched page; an object {"url": "…", "sitekey": "…"} yields the page-embedded challenge token (300s, single-use) for that page instead.

## `proxyUrl` (type: `string`):

Optional caller-supplied outbound proxy (your own residential pool or a provider you hold). Leave empty to use the managed sticky outbound connection. Mutually exclusive with country/proxyGroup.

## `maxResults` (type: `integer`):

Most rows (one per URL) to deliver and charge for this run.

## `country` (type: `string`):

Optional two-letter country code for the managed sticky outbound connection (e.g. US, DE). Ignored when proxyUrl is set.

## `proxyGroup` (type: `string`):

Optional managed sticky outbound connection group name. Leave empty for the default. Ignored when proxyUrl is set.

## Actor input object example

```json
{
  "urls": [
    "https://www.example.com/"
  ],
  "maxResults": 3
}
```

# Actor output Schema

## `rows` (type: `string`):

One row per URL with the cf_clearance value, the cookieHeader, the credential descriptor and the page body.

## `runSummary` (type: `string`):

Run summary with row counts, the input as understood, and finish times.

## `inputEcho` (type: `string`):

Input values the run actually used after normalization.

## `errorSummary` (type: `string`):

Error information when the run fails.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://www.example.com/"
    ],
    "maxResults": 3
};

// Run the Actor and wait for it to finish
const run = await client.actor("lentic_clockss/cf-clearance-solver").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": ["https://www.example.com/"],
    "maxResults": 3,
}

# Run the Actor and wait for it to finish
run = client.actor("lentic_clockss/cf-clearance-solver").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://www.example.com/"
  ],
  "maxResults": 3
}' |
apify call lentic_clockss/cf-clearance-solver --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,lentic_clockss/cf-clearance-solver"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1Cybvoa5JWJamgrtl/builds/tff0Z50HuLVnxHFVe/openapi.json