DataDome Unblocker

Get past DataDome and keep the cookie. Give this Actor a list of URLs and it returns the real page plus the datadome clearance cookie that unlocked it — so your own scraper can carry on from there without solving anything again.

No browser is involved. A solve is four HTTP requests and two to five seconds, because the challenge is solved at the payload level rather than by driving a headless Chrome through a captcha widget. That is the whole difference between this and every other anti-bot Actor on the Store.

Across repeated verification runs on Apify residential proxies, every supported site is challenged and cleared on the first attempt, in 2-5 seconds each.

It is powered by xhr.dev, a challenge solver that normally runs as a Docker container inside your own network. This Actor talks to a hosted trial of it, so you can try the thing before you host anything.

Why use DataDome Unblocker?

It gives you a cookie, not just a page. Most bypass Actors hand back HTML and throw the session away, so every single page you want costs another full bypass. DataDome binds its clearance cookie to the IP that earned it, and this Actor returns that cookie to you — pin the same proxy session in your own crawler and one solve can cover a whole crawl. That changes the economics of scraping a protected site, not just the mechanics.

It is fast because there is no browser. A stealth-browser bypass spends 20–60 seconds launching Chromium, rendering a captcha, and simulating a human. This spends about four seconds making four HTTP requests. On Apify that difference is compute units, and compute units are your bill.

It is honest about what happened. Every dataset row says whether the URL was actually challenged, which challenge type it was, how many attempts it took, and — when it failed — why, as a machine-readable errorType. A DataDome ban on your exit IP is a different problem from a solve the site refused, and the output tells them apart instead of reporting a generic failure.

Handles both DataDome challenge types. The captcha (rt: "c") and the interstitial (rt: "i"), including the case where a site escalates one into the other.

How to use DataDome Unblocker

1. Click Try for free.
2. Pick the sites you want from the Sites dropdown. The default is Grainger, a live DataDome target you can use to watch the flow work.
3. Leave the proxy on Apify Residential. Do not switch it to datacenter — it is the difference between clearing everything and clearing a quarter of it.
4. Click Start. Watch the log: it names each challenge as it finds it and each solve as it lands.
5. Take the results from the Output tab, or pull them from the dataset API. The cookieHeader field is ready to send as-is.

Input

Field	Type	Default	What it does
startUrls	array	grainger.com	The pages you want. Up to 100 per run on the shared trial solver.
proxyConfiguration	object	Apify Residential	Where requests leave from. Keep this on residential — see below.
returnHtml	boolean	true	Include the unblocked page's full HTML. Turn off for a much smaller dataset.
returnCookies	boolean	true	Include the clearance cookie and a ready-to-send Cookie header.
maxRetries	integer	3	Attempts per URL. Each takes a fresh proxy session.
maxConcurrency	integer	5	URLs in flight at once. Can go higher than a browser scraper would tolerate.
timeoutSecs	integer	120	Deadline for each HTTP request in the flow.

{
    "startUrls": [{ "url": "https://www.grainger.com/" }],
    "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": ["RESIDENTIAL"] },
    "returnHtml": false,
    "maxRetries": 3
}

Output

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

{
    "url": "https://www.grainger.com/",
    "succeeded": true,
    "challenged": true,
    "challengeType": "interstitial",
    "status": 200,
    "title": "Grainger Industrial Supply - MRO Products, Equipment and Tools",
    "cookies": { "datadome": "EJp800Jb_3j7j1tDAJFLE9Bk8wsBU0_prBlWFlDVhFZ..." },
    "cookieHeader": "datadome=EJp800Jb_3j7j1tDAJFLE9Bk8wsBU0_prBlWFlDVhFZ...",
    "attempts": 1,
    "durationMs": 3901,
    "error": null,
    "errorType": null
}

Data fields

Field	Type	Description
url	string	The URL that was requested.
succeeded	boolean	Whether the page was retrieved.
challenged	boolean	Whether DataDome actually challenged this request. false is a normal, good outcome — it means your IP was already trusted.
challengeType	string	captcha, interstitial, or null when unchallenged.
status	number	HTTP status of the final, cleared request.
title	string	The page's <title>, handy for confirming you got real content.
cookies	object	{ "datadome": "..." } — the clearance cookie.
cookieHeader	string	The same thing, ready to send as a Cookie header.
html	string	Full HTML of the unblocked page, when returnHtml is on.
attempts	number	How many tries this URL took.
durationMs	number	Wall-clock time for this URL.
error	string	Failure message, or null.
errorType	string	Machine-readable reason when succeeded is false, or null.

Which sites are supported

You pick sites from a dropdown, not a free-text box. The supported set is closed, and anything outside it is refused before the run starts — so you never pay for a run against a target nobody has verified.

Supported: Grainger · Idealista · Etsy · Yelp · Saks Fifth Avenue · Anthropologie · Best Western · Neiman Marcus · Allegro · leboncoin

Every one is challenged and cleared on the first attempt, on every verification run.

The bar for that list is deliberately strict: the site has to be challenged and the challenge actually cleared, repeatedly. A site that merely returns its pages without ever being challenged does not qualify — nothing was solved, so no clearance cookie was produced, and we would rather list fewer sites than imply a capability a run never exercised.

Need a site that is not listed? Tell us — verifying a new target is quick, and it is the most useful thing you can ask us for.

Using specific URLs

The dropdown runs each site's homepage. To target exact pages, put them in Specific URLs under Advanced; every one must sit on a supported domain.

Use residential proxies — this one is not optional

DataDome decides which challenge to serve based on the address you arrive from, and that single fact governs how this Actor behaves.

Datacenter ranges are treated as suspicious and are challenged far more aggressively. Residential addresses are treated as ordinary traffic. Everything here is built and verified around a residential exit, so set the proxy to Apify Residential and leave it there. The Actor warns you in the log if you do not.

There is a second consequence of the same rule: reuse the cookie from the exit IP that earned it. DataDome binds every clearance cookie to whoever submitted it, so a cookieHeader taken from here and sent from somewhere else gets a fresh block that looks exactly like a failed solve. Pin the same proxy session in your own scraper.

This Actor pins a fresh proxy session per attempt automatically, so a dead exit node gets a genuinely new address rather than three tries at the same one.

How much does it cost?

There is no browser here, so a run is cheap in Apify compute terms — the work is four HTTP requests and a wait. A solve takes about four seconds; an unchallenged URL takes under a second. Cost scales with URLs, not with page weight, and turning off returnHtml cuts dataset storage sharply if all you need is the cookie.

Proxy traffic is billed separately by Apify, and since residential proxies are required here, they are the larger share of the cost of any DataDome work. Residential proxy access needs a paid Apify plan.

Tips

• Turn off returnHtml if you only want cookies. It is the single biggest reduction in dataset size.
• Raise maxConcurrency before you raise anything else. The HTTP-only path parallelises well.
• Check challenged before you conclude anything about a proxy. A run of challenged: false means your IPs are trusted, which is a good outcome that can be mistaken for the Actor doing nothing.
• If results degrade, check your proxy group first. Residential is what this Actor is verified against.
• errorType: "ip_banned" means DataDome has flagged that exit address outright (t: "bv"). There is no challenge to solve — rotate proxies rather than retrying.
• errorType: "rate_limited" is the shared trial solver's per-key limit, not a fault on your side. The run stops rather than burning the rest of your list; see below.

FAQ

Which sites does this work on? The ten in the dropdown. The underlying solver is not site-specific — DataDome's challenge protocol is the same everywhere — but we only list targets we have actually verified, and we would rather add yours on request than claim untested coverage.

Does it handle Akamai, Cloudflare, or PerimeterX? Not yet. This Actor is DataDome only, deliberately, because the DataDome path needs no browser and that is where the speed advantage lives. xhr.dev also solves Akamai Bot Manager, and an Akamai Actor is next.

Why is there a 100-URL cap? This Actor is pointed at a shared trial container, rate limited per API key. The cap keeps one run from spending everyone's budget. If you need volume, you want your own container — get in touch.

Can I run the solver myself? Yes, and that is the actual product. xhr.dev ships as a Docker container that runs on your own infrastructure: your traffic goes to the target directly, and neither your cookies nor your tokens are sent to a third party. Flat fee, unlimited solves, works air-gapped. See xhr.dev and the docs.

Where are the integration examples? github.com/xhrdev/examples has the same flow written out in undici, axios, plain fetch, Python (requests / httpx / urllib), and curl, plus an MCP server so an LLM agent can solve a challenge inside its own loop.

Is scraping legal? Scraping publicly available data is broadly legal in many jurisdictions, but you are responsible for what you collect and how you use it — respect the target's Terms of Service, do not gather personal data without a lawful basis, and do not overload the sites you scrape. This Actor rate limits itself and is not built for volume abuse.

Support

Found a bug or want a target supported? Open an issue on the Issues tab. For a self-hosted deployment, higher limits, or Akamai support, reach us through xhr.dev.