> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/castle.md).

# Castle

{% hint style="info" %}
Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our [**Github repo**](https://takionapi.tech/examples)
{% endhint %}

## **What is Castle?**

Castle ([castle.io](https://castle.io/)) is an account-security anti-bot layer. It scores logins, signups, and checkouts to stop account takeovers, fake-account creation, and policy-violating abuse. To do that it monitors browser characteristics, user behavior, and request patterns, and it expects every protected call to carry a valid `x-castle-request-token` (called `castle_token` on some sites) minted from those signals and the session's `__cuid` cookie.

### Detecting a Castle site <a href="#detecting-a-castle-site" id="detecting-a-castle-site"></a>

A page runs Castle when it loads the Castle SDK from the CDN. Look for a script tag like this:

```html
<script src="https://cdn.castle.io/v2/castle.js?pk_..."></script>
```

The value after the `?` is the script context you pass as the `scriptID`. Sites also set a `__cuid` cookie on the session that the token is bound to.

Another way to identifying it, would be to search for **`castle_token`** or **`x-castle-request-token`** and varinats between the browser requests.

## Some websites using Datadome <a href="#some-websites-using-it" id="some-websites-using-it"></a>

Most of the tickets websites are using Incapsula to protect their website. Here are some examples of websites using Incapsula and the cookies/challenge they require:

| Website                                          |
| ------------------------------------------------ |
| [Rockstar Games](https://www.rockstargames.com/) |
| [X (Twitter)](https://x.com/)                    |
| [DailyPay](https://www.dailypay.com/)            |
| ...                                              |

## Our API <a href="#our-api" id="our-api"></a>

Takion generates the `castle-token` and returns it with the `__cuid` it is bound to, so you can clear Castle-protected logins and checkouts without a browser. Continue to the reference: