> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/datadome/apis.md).
# Bypass Solution
## **How the Solution Works**
To bypass DataDome's protection, follow a simple logic, when a website returns you a datadome challenge, either:\
\
The full challenge html
```html
You have been blocked | Bot or Not?
```
A redirect to follow
```json
{
"url": "https://geo.captcha-delivery.com/captcha/?initialCid=...&hash=...&cid=...&t=fe&referer=...&s=...&e=...&dm=..."
}
```
Or one to build and follow
```html
idealista.com
Please enable JS and disable any ad blocker
```
Whatever it is, you send it to us, we do the work for you and return you a valid datadome cookie. One POST.
### Endpoint
The endpoint lives on the Datadome subdomain:
```
https://datadome.takionapi.tech/generate
```
## Generate the datadome cookie
> Solves the DataDome challenge (slider or interstitial device check) from the challenge-page HTML and returns a valid \`datadome\` cookie plus the \`user\_agent\` it was minted for. Attach the cookie as \`Cookie: datadome=\\` on your own request, sent with the matching User-Agent (and ideally through /tls, below).
```json
{"openapi":"3.0.3","info":{"title":"Takion API — DataDome","version":"1.0.0"},"servers":[{"url":"https://datadome.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"GenerateRequest":{"type":"object","required":["html","referer","proxy"],"properties":{"html":{"type":"string","description":"The DataDome challenge-page HTML (the 403 body containing the `dd` object). Get it by requesting the target page via /tls.\n"},"referer":{"type":"string","description":"The Referer of the page that served the challenge."},"proxy":{"type":"string","description":"Proxy to solve behind, so the cookie binds to the right IP. Format `ip:port` or `ip:port:user:pass`.\n"},"chrome_version":{"type":"string","description":"Chrome full version to emulate."},"macos_version":{"type":"string","description":"macOS version to emulate."}},"additionalProperties":true},"GenerateResponse":{"type":"object","properties":{"cookie":{"type":"string","description":"The `datadome` cookie value. Attach it as `Cookie: datadome=`.\n"},"user_agent":{"type":"string","description":"The User-Agent the cookie was minted for — send it on the request that carries the cookie.\n"}},"additionalProperties":true},"Error":{"type":"object","description":"Every error is a JSON object with a single `error` string. Two tiers: auth/quota problems return HTTP 401 and unexpected failures return HTTP 500 (see the shared responses), while input-validation and \"blocked\" conditions on /generate return HTTP 200 with this same shape — so always check for `error` before using the result.\n","required":["error"],"properties":{"error":{"type":"string","description":"Human-readable error message."}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — returned as HTTP 401 with an `error` message (no key, bad key, quota reached, or expired key).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/generate":{"post":{"operationId":"generateDatadome","summary":"Generate the datadome cookie","description":"Solves the DataDome challenge (slider or interstitial device check) from the challenge-page HTML and returns a valid `datadome` cookie plus the `user_agent` it was minted for. Attach the cookie as `Cookie: datadome=` on your own request, sent with the matching User-Agent (and ideally through /tls, below).\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateRequest"}}}},"responses":{"200":{"description":"Success returns the generated cookie. IMPORTANT: input-validation and \"blocked\" conditions ALSO return HTTP 200 with an `error` field (not a 4xx), so always check for `error` before reading `cookie`.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/GenerateResponse"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```
## Send a TLS-fingerprinted request (optional)
> Sends an HTTP request from Takion with a realistic browser TLS\
> fingerprint and header order, through your proxy — used to fetch the\
> DataDome challenge page (you get back the 403 + challenge HTML to feed\
> into \`/generate\`) and to re-request the protected page with the\
> \`datadome\` cookie attached.\
> \
> \*\*(Important) This endpoint is optional.\*\* If your own HTTP client\
> already reproduces the TLS and header fingerprint that matches the\
> User-Agent you send, you are good to go — just attach the cookie from\
> \`/generate\` to your own requests and skip \`/tls\` entirely.\
> \
> Use \`/tls\` only if you cannot match that fingerprint yourself. It is\
> always kept up to date and backed by a large bank of TLS\
> fingerprints / User-Agents, so you never have to chase browser changes.
```json
{"openapi":"3.0.3","info":{"title":"Takion API — DataDome","version":"1.0.0"},"servers":[{"url":"https://datadome.takionapi.tech"}],"security":[{"ApiKeyHeader":[]},{"ApiKeyQuery":[]}],"components":{"securitySchemes":{"ApiKeyHeader":{"type":"apiKey","in":"header","name":"x-api-key"},"ApiKeyQuery":{"type":"apiKey","in":"query","name":"api_key"}},"schemas":{"TlsRequest":{"type":"object","required":["proxy","method","url"],"properties":{"proxy":{"type":"string","description":"Proxy in `ip:port` or `ip:port:user:pass` format."},"method":{"type":"string","description":"HTTP method for the upstream request.","enum":["GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"]},"url":{"type":"string","format":"uri","description":"The target URL to request."},"headers":{"type":"object","nullable":true,"additionalProperties":{"type":"string"},"description":"Request headers to send upstream (order is preserved)."},"json":{"type":"object","nullable":true,"description":"JSON body to send (sets a JSON content type).","additionalProperties":true},"data":{"type":"string","nullable":true,"description":"Raw request body (alternative to `json`)."}},"additionalProperties":true},"TlsResponse":{"type":"object","properties":{"status_code":{"type":"integer","description":"HTTP status returned by the upstream server."},"body":{"type":"string","description":"Raw response body from the upstream server."},"headers":{"type":"object","additionalProperties":{"type":"string"},"description":"Response headers from the upstream server."}},"additionalProperties":true},"Error":{"type":"object","description":"Every error is a JSON object with a single `error` string. Two tiers: auth/quota problems return HTTP 401 and unexpected failures return HTTP 500 (see the shared responses), while input-validation and \"blocked\" conditions on /generate return HTTP 200 with this same shape — so always check for `error` before using the result.\n","required":["error"],"properties":{"error":{"type":"string","description":"Human-readable error message."}}}},"responses":{"Unauthorized":{"description":"Authentication or quota failure — returned as HTTP 401 with an `error` message (no key, bad key, quota reached, or expired key).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServerError":{"description":"Unexpected server error (HTTP 500).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/tls":{"post":{"operationId":"tlsRequest","summary":"Send a TLS-fingerprinted request (optional)","description":"Sends an HTTP request from Takion with a realistic browser TLS\nfingerprint and header order, through your proxy — used to fetch the\nDataDome challenge page (you get back the 403 + challenge HTML to feed\ninto `/generate`) and to re-request the protected page with the\n`datadome` cookie attached.\n\n**(Important) This endpoint is optional.** If your own HTTP client\nalready reproduces the TLS and header fingerprint that matches the\nUser-Agent you send, you are good to go — just attach the cookie from\n`/generate` to your own requests and skip `/tls` entirely.\n\nUse `/tls` only if you cannot match that fingerprint yourself. It is\nalways kept up to date and backed by a large bank of TLS\nfingerprints / User-Agents, so you never have to chase browser changes.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TlsRequest"}}}},"responses":{"200":{"description":"The upstream response. On a bad request the API returns 200 with an `error` field instead of an HTTP error, so check for `error` first.\n","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/TlsResponse"},{"$ref":"#/components/schemas/Error"}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/ServerError"}}}}}}
```