> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/castle/api.md).
# Bypass Solution
### How the solution works
To bypass Castle:
1. Identify the target use a supported `website` shortcut (e.g. `twitter`, `rockstar`) or parse the **site key** (`pk_...`) from the page and pass it as `site_key`.
2. Call `/generate` with that, plus your session's `__cuid` if you already have one.
3. Read `token` from the response and attach it where the target expects it, carrying `__cuid` alongside.
### Endpoint
The endpoint lives on the Castle subdomain:
```
https://castle.takionapi.tech/generate
```
## Generate the Castle request token
> Returns a valid \`x-castle-request-token\` and the \`\_\_cuid\` cookie it is bound to. Identify the target with either the \`website\` shortcut (e.g. \`twitter\`, \`rockstar\`) or the page's \`site\_key\` (the \`pk\_...\` value). Pass your own \`\_\_cuid\` to bind to an existing session, or omit it and one is generated for you.
```json
{"openapi":"3.0.3","info":{"title":"Takion API — Castle","version":"1.0.0"},"servers":[{"url":"https://castle.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"GenerateResponse":{"type":"object","properties":{"token":{"type":"string","description":"The Castle request token — send it as the `x-castle-request-token` header (or `castle_token` where the site expects that name).\n"},"__cuid":{"type":"string","description":"The `__cuid` the token is bound to — carry it on the same session."}},"additionalProperties":true},"Error":{"type":"object","required":["error"],"description":"Every error is a JSON object with a single `error` string. Auth/quota problems return HTTP 401 and unexpected failures 500; input-validation errors on /generate return HTTP 200 with this shape — always check for `error` before using `token`.\n","properties":{"error":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — HTTP 401 with an `error` message.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/generate":{"get":{"operationId":"generateCastleToken","summary":"Generate the Castle request token","description":"Returns a valid `x-castle-request-token` and the `__cuid` cookie it is bound to. Identify the target with either the `website` shortcut (e.g. `twitter`, `rockstar`) or the page's `site_key` (the `pk_...` value). Pass your own `__cuid` to bind to an existing session, or omit it and one is generated for you.\n","parameters":[{"name":"website","in":"query","required":false,"description":"Shortcut for a supported target so you don't have to parse the site key yourself. Provide this OR `site_key`.\n","schema":{"type":"string"}},{"name":"site_key","in":"query","required":false,"description":"The Castle public key (`pk_...`) from the page. Provide this OR `website`.","schema":{"type":"string"}},{"name":"__cuid","in":"query","required":false,"description":"Your session's `__cuid`. If omitted, Takion generates one and returns it — keep it on the session that sends the token.\n","schema":{"type":"string"}},{"name":"api_key","in":"query","required":false,"description":"Your API key (alternative to the x-api-key header; either is accepted).\n","schema":{"type":"string"}}],"responses":{"200":{"description":"Success returns the token + __cuid. On a bad request the API returns HTTP 200 with an `error` field instead — always check for `error` before reading `token`.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/GenerateResponse"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```
## Send a TLS-fingerprinted request (optional)
> Sends an HTTP request from Takion with a realistic browser TLS\
> fingerprint, through your proxy, carrying your cookie jar (including\
> \`\_\_cuid\`).\
> \
> \*\*(Important) This endpoint is optional.\*\* If your own client already\
> reproduces the TLS + header fingerprint matching your User-Agent, just\
> attach the \`x-castle-request-token\` and \`\_\_cuid\` from /generate to your\
> own request and skip /tls. Use it only when you can't match the\
> fingerprint yourself — it is always kept up to date.
```json
{"openapi":"3.0.3","info":{"title":"Takion API — Castle","version":"1.0.0"},"servers":[{"url":"https://castle.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"TlsRequest":{"type":"object","required":["proxy","method","url"],"properties":{"proxy":{"type":"string","description":"Proxy in `ip:port` or `ip:port:user:pass` format."},"method":{"type":"string","enum":["GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"]},"url":{"type":"string","format":"uri"},"headers":{"type":"object","nullable":true,"additionalProperties":{"type":"string"}},"json":{"type":"object","nullable":true,"additionalProperties":true},"data":{"type":"string","nullable":true},"params":{"type":"object","nullable":true,"additionalProperties":{"type":"string"},"description":"Query parameters to append to the URL."},"verify":{"type":"boolean","description":"Whether to verify TLS certificates upstream."}},"additionalProperties":true},"TlsResponse":{"type":"object","properties":{"status_code":{"type":"integer"},"body":{"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}}},"additionalProperties":true},"Error":{"type":"object","required":["error"],"description":"Every error is a JSON object with a single `error` string. Auth/quota problems return HTTP 401 and unexpected failures 500; input-validation errors on /generate return HTTP 200 with this shape — always check for `error` before using `token`.\n","properties":{"error":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — HTTP 401 with an `error` message.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/tls":{"post":{"operationId":"castleTlsRequest","summary":"Send a TLS-fingerprinted request (optional)","description":"Sends an HTTP request from Takion with a realistic browser TLS\nfingerprint, through your proxy, carrying your cookie jar (including\n`__cuid`).\n\n**(Important) This endpoint is optional.** If your own client already\nreproduces the TLS + header fingerprint matching your User-Agent, just\nattach the `x-castle-request-token` and `__cuid` from /generate to your\nown request and skip /tls. Use it only when you can't match the\nfingerprint yourself — it is always kept up to date.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TlsRequest"}}}},"responses":{"200":{"description":"The upstream response (or an `error` field).","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/TlsResponse"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```