Scarnox · Blog

How to bypass captcha for legitimate automation and testing

To bypass a captcha legitimately means to get your own automated work past a challenge without breaking the site's rules or attacking its users. In practice that covers four cases: automating a workflow you own, testing your own site, building accessible tooling, and collecting public data at a responsible rate. The fastest honest route is usually to avoid triggering the captcha at all. When you cannot avoid it, a solver API such as Scarnox can return the token the page expects.

This guide sets out the approaches in the order you should try them, and marks the boundaries you should not cross.

Start by asking why the captcha appeared

Captchas are a signal. The site decided that a request looked automated or risky. Before you try to get past the challenge, check what caused it:

Request rate. Many captchas appear only after a burst of requests from one address.
Missing session state. A visitor who arrives with no cookies, no history and no login looks like a scraper.
Browser signals. Headless browsers and default automation settings are often flagged. The headless browser detection guide explains the common ones.
Network reputation. Datacenter addresses are scrutinised more than home connections.

Fixing the cause often removes the captcha entirely, which is better than solving it on every request.

Try the approaches that avoid the challenge

Use an official API if one exists. Many sites publish data through an API with its own keys and limits. That route is faster, more stable and clearly allowed.
Slow down and spread requests out. Add delays between requests, cap concurrency and back off when you get a warning. A steady pace of a few requests a minute looks very different to a site than a burst of hundreds.
Keep sessions. Reuse cookies and a consistent browser profile across a session, rather than starting fresh on every page. The browser fingerprinting guide covers why this matters.
Check robots.txt and the terms of service before you start, not after you get blocked. Respect what the site asks for.

Use test keys and test environments

If the captcha is blocking your own staging environment, do not point your tests at production to get around it. Most captcha vendors, including Google and Cloudflare, publish test keys for development. These keys produce a valid token without a real challenge, and they are the correct tool for automated tests. You can also ask your own team to disable the captcha on the staging server. The captcha in automated tests guide walks through this setup.

Solve the captcha through an API when it is in front of legitimate work

Some captchas will still appear on a legitimate job, even with good pacing. A monitoring job that checks your own supplier's portal is one example. In that case a solver API is the appropriate tool.

Scarnox is a captcha solving API. Today the only live task type is PopularCaptcha, proxyless. Your code sends the sitekey and page URL, and receives a token to submit with the form:

import requests

r = requests.post(
    "https://api.scarnox.com/api/tasks/create",
    headers={"Authorization": "Bearer scarnox_YOURAPIKEY"},
    json={
        "captcha_type": "PopularCaptchaTaskProxyless",
        "site_key": "10000000-ffff-ffff-ffff-000000000001",
        "site_url": "https://example.com/login",
    },
    timeout=185,
)
data = r.json()
token = data["solution"]["token"] if data.get("errorId") == 0 else None

The token expires in about two minutes, so submit it immediately. The solve captcha with Python guide has the full example. Other captcha types, including reCAPTCHA, Cloudflare Turnstile and Arkose, are coming soon. Until they ship, do not assume a solver handles them.

Accessibility is a legitimate reason too

Captchas are a barrier for people who use screen readers, switch devices or have cognitive or visual impairments. If you build accessibility tooling, or you act for users who cannot complete a challenge, the right first step is to ask the site owner for an accessible alternative. Many sites offer one. Automating a captcha is not a substitute for that conversation.

What is not legitimate

Some uses of captcha solving are out of bounds, whatever the reason given. Do not use solvers or any bypass for:

credential stuffing or any attempt to log in to accounts you do not own;
spam signups, fake reviews or fake accounts;
buying tickets, stock or limited goods ahead of other customers;
attacking login forms, password reset flows or rate limits on someone else's service.

These uses harm real people, break site terms and expose you to serious legal risk. Scarnox does not support them, and this guide does not cover them.

Scrape responsibly

If your bypass exists to collect public data, keep these points in mind:

Check robots.txt and the site's terms. A site that prohibits scraping has told you what it expects.
Set a sensible rate limit and back off on errors. Overloading a small site is a real harm.
Do not collect personal data you do not need. Personal data is subject to laws such as GDPR, and collecting it carelessly creates liability. The is web scraping legal guide explains the main considerations.

Summary

Avoid the captcha first by fixing the cause. Use test keys for testing. Use a solver API for legitimate jobs that still hit a challenge, within the live task types. Stay out of the uses listed above, and scrape at a pace a site can carry.