Ctrlk
Start a TrialJoin our DiscordBuy a PlanDashboard
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Bypass Solution

Our solution automates solving challenges like sliding captchas and interstitial device checks, allowing seamless access to Datadome protected websites without any worry.

How the Solution Works

To bypass DataDome's protection, follow a simple logic, when a website returns you a datadome challenge, either: The full challenge html

<!DOCTYPE html>
<html lang="en"  style="background-color:#ffffff">
    <head>
        <title>You have been blocked | Bot or Not?</title>
<!-- ... --->

A redirect to follow

{
    "url": "https://geo.captcha-delivery.com/captcha/?initialCid=...&hash=...&cid=...&t=fe&referer=...&s=...&e=...&dm=..."
}

Or one to build and follow

<html lang="es">
    <head>
        <title>idealista.com</title>
    </head>
    <body style="margin:0">
        <p id="cmsg">Please enable JS and disable any ad blocker</p>
        <script data-cfasync="false">
            var dd = {
                'rt': 'i',
                'cid': 'AHrlqAAAAAMAycYDrCG87_UAVNwdBA==',
                'hsh': 'AC81AADC3279CA4C7B968B717FBB30',
                'b': 1709036,
                's': 17156,
                'e': '...',
                'qp': '',
                'host': 'geo.captcha-delivery.com',
                'cookie': '...'
            }
        </script>
        <script data-cfasync="false" src="https://ct.captcha-delivery.com/i.js"></script>
    </body>
</html>

Whatever it is, you send it to us, we do the work for you and return you a valid datadome cookie. One POST.

Endpoint

The endpoint lives on the Datadome subdomain:

Generate the datadome cookie

post

Solves the DataDome challenge (slider or interstitial device check) from the challenge-page HTML and returns a valid datadome cookie plus the user_agent it was minted for. Attach the cookie as Cookie: datadome=<cookie> on your own request, sent with the matching User-Agent (and ideally through /tls, below).

Authorizations
x-api-keystringRequired
Body
htmlstringRequired

The DataDome challenge-page HTML (the 403 body containing the dd object). Get it by requesting the target page via /tls.

Example: <html>…var dd={...}…</html>
refererstringRequired

The Referer of the page that served the challenge.

Example: https://access.tickets.fifa.com/
proxystringRequired

Proxy to solve behind, so the cookie binds to the right IP. Format ip:port or ip:port:user:pass.

Example: 1.2.3.4:8000:user:pass
chrome_versionstringOptional

Chrome full version to emulate.

Example: 149.0.7480.66
macos_versionstringOptional

macOS version to emulate.

Example: 26.1.0
Other propertiesanyOptional
Responses
200

Success returns the generated cookie. IMPORTANT: input-validation and "blocked" conditions ALSO return HTTP 200 with an error field (not a 4xx), so always check for error before reading cookie.

application/json
or
post/generate

Send a TLS-fingerprinted request (optional)

post

Sends an HTTP request from Takion with a realistic browser TLS fingerprint and header order, through your proxy — used to fetch the DataDome challenge page (you get back the 403 + challenge HTML to feed into /generate) and to re-request the protected page with the datadome cookie attached.

(Important) This endpoint is optional. If your own HTTP client already reproduces the TLS and header fingerprint that matches the User-Agent you send, you are good to go — just attach the cookie from /generate to your own requests and skip /tls entirely.

Use /tls only if you cannot match that fingerprint yourself. It is always kept up to date and backed by a large bank of TLS fingerprints / User-Agents, so you never have to chase browser changes.

Authorizations
x-api-keystringRequired
Body
proxystringRequired

Proxy in ip:port or ip:port:user:pass format.

Example: 1.2.3.4:8000:user:pass
methodstring · enumRequired

HTTP method for the upstream request.

Example: GETPossible values:
urlstring · uriRequired

The target URL to request.

Example: https://access.tickets.fifa.com/
datastring · nullableOptional

Raw request body (alternative to json).

Other propertiesanyOptional
Responses
200

The upstream response. On a bad request the API returns 200 with an error field instead of an HTTP error, so check for error first.

application/json
or
post/tls
PreviousDatadomeNextPerimeter X Mobile

Last updated