Castle

A Castle bypass without a browser. Takion generates a valid x-castle-request-token / castle_token in one call, so your login and checkout requests clear Castle's risk check and go through.

Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our Github repo

What is Castle?

Castle (castle.io) is an account-security anti-bot layer. It scores logins, signups, and checkouts to stop account takeovers, fake-account creation, and policy-violating abuse. To do that it monitors browser characteristics, user behavior, and request patterns, and it expects every protected call to carry a valid x-castle-request-token (called castle_token on some sites) minted from those signals and the session's __cuid cookie.

Detecting a Castle site

A page runs Castle when it loads the Castle SDK from the CDN. Look for a script tag like this:

<script src="https://cdn.castle.io/v2/castle.js?pk_..."></script>

The value after the ? is the script context you pass as the scriptID. Sites also set a __cuid cookie on the session that the token is bound to.

Another way to identifying it, would be to search for castle_token or x-castle-request-token and varinats between the browser requests.

Some websites using Datadome

Most of the tickets websites are using Incapsula to protect their website. Here are some examples of websites using Incapsula and the cookies/challenge they require:

Website
Rockstar Games
X (Twitter)
DailyPay
...

Our API

Takion generates the castle-token and returns it with the __cuid it is bound to, so you can clear Castle-protected logins and checkouts without a browser. Continue to the reference: