Datadome

A DataDome bypass without a browser. Takion solves DataDome's tags.js (ch/le), captcha, and interstitial challenges and returns a valid Datadome cookie, so your requests get through and stay through.

Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our Github repo

What is Datadome?

DataDome is an application-layer (layer 7) bot-management system that protects sites against scraping, credential stuffing, and DDoS. It scores every request on signals like TLS fingerprint and HTTP header order, and when something looks automated it issues a challenge. Because its detection is so sensitive, a working bypass has to replicate a real browser's request shape precisely. The TLS signature and the exact order of headers both matter.

A rotating proxy pool is recommended: IP bans are common, and rotating IPs keeps disruption low.

How Datadome Works

On first visit, or after a number of requests, a protected site challenges you and, once solved, issues a datadome cookie that grants access for a set period. If a site sets a datadome cookie, it is running DataDome.

There are two main challenge types:

Datadome challenges

GeeTest (Sliding Captcha)

This requires solving a sliding puzzle before access is granted

Based on the website configuration the puzzle resolution could be omitted, asking only for a swipe, the flow is the same.

Interstitial Device Check

This newer challenge verifies a user’s device, sometimes displaying a blank page or a "Verify your device" message.

Detecting Datadome Websites

When you hit a DataDome-protected page you often get a 403 with an unusual HTML body. The key part is the dd object, which is used to build the challenge URL:

<html>
    <head>
        <title>footlocker.com</title>
    </head>
    <body style="margin:0">
        <p id="cmsg">Please enable JS and disable any ad blocker</p>
        <script data-cfasync="false">
            var dd = {
                'rt': 'i',
                'cid': 'AHrlqAAAAAMAxVzL7Hc0p40AWXJFuQ==',
                'hsh': 'A55FBF4311ED6F1BF9911EB71931D5',
                'b': 1239798,
                's': 17434,
                'host': 'geo.captcha-delivery.com'
            }
        </script>
        <script data-cfasync='false'>
            (function() {
                // ...
            }
            )();
        </script>
        <script data-cfasync="false" src="https://interstitial.captcha-delivery.com/i.js"></script>
    </body>
</html>

The rt field tells you which challenge you are facing before you even start:

i: interstitial
c: captcha slider

Some sites ship a custom implementation and may return JSON or a different HTML shape. Detect on the datadome cookie and the dd object rather than on an exact page layout.

Some websites using Datadome

Most of the tickets websites are using Incapsula to protect their website. Here are some examples of websites using Incapsula and the cookies/challenge they require:

Website

footlocker.com (and all other domains)

uefa

hermes.com

ticketing.liverpoolfc.com

ticketing.manutd.com

tickets.mancity.com

seatgeek.com

...

Our API

Takion automates the whole challenge flow and returns the datadome cookie, so you can access protected sites without solving anything yourself. Continue to the reference

PreviousInteracting with our APIs NextBypass Solution

Last updated 26 days ago