Bypass Solution

The Castle bypass runs in one call: GET /generate with the target (a website shortcut or the page's site_key) returns a valid token

How the solution works

To bypass Castle:

1. Identify the target use a supported website shortcut (e.g. twitter, rockstar) or parse the site key (pk_...) from the page and pass it as site_key.

2. Call /generate with that, plus your session's __cuid if you already have one.

3. Read token from the response and attach it where the target expects it, carrying __cuid alongside.

Endpoint

The endpoint lives on the Castle subdomain:

https://castle.takionapi.tech/generate

Generate the Castle request token

get

Returns a valid x-castle-request-token and the __cuid cookie it is bound to. Identify the target with either the website shortcut (e.g. twitter, rockstar) or the page's site_key (the pk_... value). Pass your own __cuid to bind to an existing session, or omit it and one is generated for you.

Authorizations

x-api-keystringRequired

Query parameters

websitestringOptional

Shortcut for a supported target so you don't have to parse the site key yourself. Provide this OR site_key.

Example: {"value":"twitter"}

site_keystringOptional

The Castle public key (pk_...) from the page. Provide this OR website.

Example: pk_live_XXXXXXXXXXXXXXXX

__cuidstringOptional

Your session's __cuid. If omitted, Takion generates one and returns it — keep it on the session that sends the token.

api_keystringOptional

Your API key (alternative to the x-api-key header; either is accepted).

Responses

200

Success returns the token + __cuid. On a bad request the API returns HTTP 200 with an error field instead — always check for error before reading token.

application/json

or

401

Authentication or quota failure — HTTP 401 with an error message.

application/json

500

Unexpected server error (HTTP 500).

application/json

get/generate

GET /generate HTTP/1.1
Host: castle.takionapi.tech
x-api-key: YOUR_API_KEY
Accept: */*

{
  "token": "<x-castle-request-token>",
  "__cuid": "<cuid>"
}

Send a TLS-fingerprinted request (optional)

post

Sends an HTTP request from Takion with a realistic browser TLS fingerprint, through your proxy, carrying your cookie jar (including __cuid).

(Important) This endpoint is optional. If your own client already reproduces the TLS + header fingerprint matching your User-Agent, just attach the x-castle-request-token and __cuid from /generate to your own request and skip /tls. Use it only when you can't match the fingerprint yourself — it is always kept up to date.

Authorizations

x-api-keystringRequired

Body

proxystringRequired

Proxy in ip:port or ip:port:user:pass format.

Example: 1.2.3.4:8000:user:pass

methodstring · enumRequiredExample: GETPossible values:

urlstring · uriRequiredExample: https://x.com/i/api/…

datastring · nullableOptional

verifybooleanOptional

Whether to verify TLS certificates upstream.

Example: false

Other propertiesanyOptional

Responses

200

The upstream response (or an error field).

application/json

or

401

Authentication or quota failure — HTTP 401 with an error message.

application/json

500

Unexpected server error (HTTP 500).

application/json

post/tls

POST /tls HTTP/1.1
Host: castle.takionapi.tech
x-api-key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 282

{
  "proxy": "1.2.3.4:8000:user:pass",
  "method": "GET",
  "url": "https://x.com/i/api/…",
  "headers": {
    "ANY_ADDITIONAL_PROPERTY": "text"
  },
  "json": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "data": "text",
  "params": {
    "ANY_ADDITIONAL_PROPERTY": "text"
  },
  "verify": false,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "status_code": 200,
  "body": "text",
  "headers": {
    "ANY_ADDITIONAL_PROPERTY": "text"
  },
  "ANY_ADDITIONAL_PROPERTY": "anything"
}