Scarnox · Blog

How to find a captcha sitekey on any page (4 ways)

Every captcha solve starts with the sitekey: the public ID the site registered with the captcha provider. The browser can see it, so you can read it too. For PopularCaptcha, the sitekey is a UUID such as a5f74b19-9e45-40e0-b45d-47ff91b7a6c2. Other providers use different formats. Google reCAPTCHA keys, for example, start with 6L. Here are four places to find it, from easiest to most reliable.

Scarnox solves PopularCaptcha today. The sitekey lookup works the same way for any captcha, so these methods also help when you plan for another type. Other types, such as reCAPTCHA and Cloudflare Turnstile, are coming soon.

1. The data-sitekey attribute

Open DevTools (F12), go to Elements, press Ctrl+F and search for data-sitekey. Most widgets put the key in an attribute like this:

<div class="h-captcha" data-sitekey="a5f74b19-9e45-40e0-b45d-47ff91b7a6c2"></div>

If you find it here, you are done. Copy the value and move on to the solve.

2. The network tab

If the widget is rendered by JavaScript, the attribute may never appear in the HTML. Open Network, reload the page, and filter for the widget's configuration request. For PopularCaptcha that request is usually named checksiteconfig. The sitekey is one of its query parameters:

.../checksiteconfig?v=...&host=example.com&sitekey=a5f74b19-...

Filtering by the word sitekey in the request URL also works if the name differs on the site you are testing.

3. The iframe URL

The challenge itself is an iframe served by the captcha provider. Its src carries the sitekey as a parameter. Right-click the widget, choose Inspect, and read the value from the iframe's address. This is the most reliable method when the page hides the attribute from the main document.

4. Invisible widgets

An invisible widget has no checkbox. The site calls the widget's render() or execute() function from its own code, and the sitekey is passed as an argument. Search the page's JavaScript for it: open the Sources panel and press Ctrl+Shift+F, then search for sitekey. Invisible sitekeys need the invisible flag when you solve them. See solving invisible captchas.

Reading the sitekey from a script

If the attribute is in the raw HTML, a script can read it without a browser:

import re
import requests

html = requests.get("https://example.com/signup", timeout=30).text
m = re.search(r'data-sitekey="([^"]+)"', html)
print(m.group(1) if m else "no data-sitekey in the raw HTML")

If this prints nothing, the widget is rendered by JavaScript. Use a real browser, as in the Network tab method above. Only fetch pages you are allowed to automate, and keep your request rate low.

Which URL goes with it?

Send the URL of the page the widget is on as site_url. The host is what matters most, so https://example.com/signup is the value to use for a sign-up widget. A complete request for PopularCaptcha looks like this:

{
  "captcha_type": "PopularCaptchaTaskProxyless",
  "site_key": "a5f74b19-9e45-40e0-b45d-47ff91b7a6c2",
  "site_url": "https://example.com/signup"
}

Send it to https://api.scarnox.com/api/tasks/create with your key in the Authorization: Bearer header. The call blocks until the token is ready, so there is no second request to check the result.

Common problems

Two sitekeys on one page. Sites sometimes include a widget for a login form and another for sign-up. Match the key to the form that actually rejects you, and check which one sits closest to the submit button.
The key changes between visits. Read it fresh on each run. Keys are normally stable, but a cached key from an old deploy can stop working.
The key is found, but the token is rejected. The sitekey is probably right. Check the widget size and the proxy setting next, starting with the invisible captcha guide and the proxy comparison.

Checking that you have the right sitekey

A page can contain more than one sitekey. Analytics widgets, comment forms and newsletter boxes sometimes add their own. Before you solve, confirm that the sitekey belongs to the form you are automating. Three quick checks help:

Find the form's submit button in DevTools and walk up the DOM to the nearest element that holds a data-sitekey. That is the widget that guards the form.
Compare the key with the one in the iframe URL. If they match, you have the key the widget actually uses.
Submit the form by hand once with a solved token, if you are allowed to, and check that the site accepts it.

Keys can also change when a site is redeployed. If a key that worked yesterday stops producing accepted tokens, read the page again before you change anything else. A fresh read costs nothing, and it rules out the most common cause of a sudden failure.

Pages that load the widget only after a click need one more step. Open the page, perform the click that shows the widget, and only then read the sitekey. Reading the page before the click returns nothing, which looks like a missing widget but is really a timing issue. Wait for an element matching [data-sitekey] to appear rather than sleeping for a fixed time.

Next steps

Start with free trial credit, no card needed: create an account and test your first sitekey.