Token-Based vs Cookie-Based CAPTCHA Solving

CAPTCHA solutions come in two forms: tokens that you inject into form submissions, and cookies that grant session-level access. Choosing the right approach depends on which CAPTCHA you're facing and how the target site validates it.

At a glance

Token-based solving

How it works

1. Extract the sitekey from the page
2. Submit sitekey + page URL to CaptchaAI
3. Receive a token string
4. Inject the token into the hidden form field
5. Submit the form

Which CAPTCHAs use tokens

• reCAPTCHA v2: Token goes into g-recaptcha-response textarea
• reCAPTCHA v3: Same field, but also need action and min_score
• hCaptcha: Token goes into h-captcha-response
• Turnstile: Token goes into cf-turnstile-response

Implementation

import requests
import time

API_KEY = "YOUR_API_KEY"

# 1. Solve
resp = requests.post("https://ocr.captchaai.com/in.php", data={
    "key": API_KEY,
    "method": "userrecaptcha",
    "googlekey": "6Le-wvkSAAAAAPBMR...",
    "pageurl": "https://example.com/login",
    "json": "1",
}).json()
task_id = resp["request"]

# 2. Poll
token = None
for _ in range(24):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": API_KEY, "action": "get", "id": task_id, "json": "1"
    }).json()
    if result["status"] == 1:
        token = result["request"]
        break

# 3. Submit form with token (no browser needed)
form_response = requests.post("https://example.com/login", data={
    "email": "user@example.com",
    "password": "password",
    "g-recaptcha-response": token,
})

Key characteristics

• No browser needed for submission: You can inject the token directly into an HTTP POST request
• Short-lived: Tokens expire in 60-120 seconds — solve and use immediately
• Single use: Each token works once; solve again for each form submission
• Server-side validation: The target site sends the token to Google/Cloudflare/hCaptcha for verification

Cookie-based solving

How it works

1. A challenge page is served (Cloudflare Challenge, JS Challenge)
2. A browser solves the challenge (may involve Turnstile internally)
3. The server sets a session cookie (cf_clearance)
4. All subsequent requests with that cookie skip the challenge

Which CAPTCHAs use cookies

• Cloudflare Challenge pages: cf_clearance cookie
• JS Challenge: Cloudflare JavaScript-only challenge
• Some WAF challenges: Various Web Application Firewalls

Implementation

from selenium import webdriver
import requests
import time

# 1. Solve the challenge in a browser
driver = webdriver.Chrome()
driver.get("https://example.com/protected")

# Wait for challenge to complete (manually or with CaptchaAI)
time.sleep(10)  # Or use CaptchaAI token injection

# 2. Extract cookies from browser
cookies = driver.get_cookies()
cf_clearance = next(
    (c for c in cookies if c["name"] == "cf_clearance"), None
)
user_agent = driver.execute_script("return navigator.userAgent")
driver.quit()

# 3. Use cookies for subsequent requests (no browser needed)
session = requests.Session()
session.headers.update({"User-Agent": user_agent})

for cookie in cookies:
    session.cookies.set(cookie["name"], cookie["value"])

# All requests now pass the challenge
for page in range(1, 50):
    resp = session.get(f"https://example.com/api/data?page={page}")
    print(f"Page {page}: {resp.status_code}")

Key characteristics

• Browser required for solving: The challenge needs a full browser environment
• Long-lived: Cookies last 30 minutes to 24 hours
• Reusable: One solve grants access to many requests
• IP-bound: The cookie is tied to the IP that solved the challenge
• UA-bound: The User-Agent must match the one used during solving

When to use which

Hybrid approach

Some sites use both: a Cloudflare Challenge page (cookie) protecting a form that has reCAPTCHA (token).

# Step 1: Get past Cloudflare (cookie)
session = get_cf_clearance_session("https://example.com")

# Step 2: Load the form (using the cookie session)
html = session.get("https://example.com/submit").text
sitekey = extract_sitekey(html)

# Step 3: Solve reCAPTCHA (token)
token = solve_recaptcha(sitekey, "https://example.com/submit")

# Step 4: Submit form (cookie + token)
resp = session.post("https://example.com/submit", data={
    "data": "value",
    "g-recaptcha-response": token,
})

Comparison summary

FAQ

Can I convert a token-based CAPTCHA to cookie-based?

No. The approach depends on how the site validates. reCAPTCHA always uses tokens; Cloudflare Challenge always uses cookies.

Which is cheaper for high-volume scraping?

Cookie-based is far cheaper when available. One solve covers thousands of requests. Token-based requires a solve per form submission.

Does CaptchaAI handle both?

Yes. Token-based CAPTCHAs return a token string. For Cloudflare Challenge pages, you can use the Turnstile solver to get the token needed to complete the challenge, then extract the resulting cookie.

Solve CAPTCHAs with CaptchaAI

Get your API key at captchaai.com.

Related guides

• Cloudflare Challenge cf_clearance Cookie Guide
• Extracting reCAPTCHA Parameters
• Turnstile vs hCaptcha vs reCAPTCHA