Skip to main content
Cloudflare Turnstile runs invisibly for most visitors and only shows a visible challenge when traffic looks suspicious — it can appear as a Managed, Non-Interactive, or Interactive challenge depending on the risk signal. Surfsky includes an internal manual solver and automatic mode; for a first test, use manual mode after the challenge appears.

​
Before you start

Use the CAPTCHA setup example to start a browser with anti_captcha.enabled: true and create a page-level cdp session. The snippets below use an async Playwright or Puppeteer session after navigating to your target. The internal solver does not require an external provider key. To test it without another solver acting on the same challenge, start with disable_external_providers: true.
Turnstile signals include browser-level checks like TLS fingerprint and Client Hints, not just the visible widget. A page can still block a request that never shows a challenge at all — the invisible check is not the same as “no protection.”

​
Manual captcha solving

Wait for the challenge to appear, then send:
The timeout is in milliseconds. Detection can raise a CDP error when the expected challenge is absent. After success, wait for a selector or response that identifies the protected content.

​
Automatic captcha solving

Include "turnstile" in anti_captcha.auto_captcha_types at startup. Attach solve event listeners, then start detection before navigating:
status: "started" confirms the background loop started. Observe failures and use a bounded wait for your page result. Keep the CDP session connected until the job completes.

​
Reducing challenges

Most Turnstile checks run invisibly and never surface a challenge for a clean session — a widget only appears once the risk signal is high enough. If detection consistently fails to find the challenge, inspect the page for a Turnstile iframe and wait for it to load; the page may have already passed the invisible check, or it may be blocked before a challenge ever renders.

​
Verify bypass worked

status: "success" confirms the challenge widget accepted the interaction, not that the target page unblocked the protected content. Wait for a selector or response that identifies that content before treating the job as done. Check solver configuration, inspect one attempt in DevTools, and record the result or error before retrying. Stop the browser when the job ends.

​
Turnstile bypass FAQ

No — most visitors pass invisibly. Cloudflare only surfaces a Managed, Non-Interactive, or Interactive widget when the risk signal from behavior and browser fingerprint is high enough.
No. The internal solver handles it without one. Use disable_external_providers: true if you want to confirm the internal solver alone is doing the work.
The page may have already passed the invisible check with no widget shown, or it may be blocking the request before any challenge renders. Inspect for a Turnstile iframe and wait for it to load before assuming detection is broken.
A success status confirms the widget accepted the interaction, not that the site’s own check passed. Wait for the protected content or a successful response before assuming the job is done.
Questions? Contact support.