Cloudflare challenge solving
Turnstile tokens and WAFv3 clearance.
A synchronous API for your servers and automation, and a free Chrome extension for your own browser.
Two ways to use it
NullFlare API
Send one JSON request. The solve runs immediately and the result returns on the same connection. There are no task IDs and nothing to poll. Solves Turnstile widgets and WAFv3 interstitial challenges, with a per-request proxy.
Chrome extension Free
NullFlare Turnstile Solver clicks supported Turnstile checkboxes for you, after a delay you choose, from instant to ten seconds. It runs in your own browser, needs no API key, and collects no data.
Two solve types
Turnstile
Provide the page URL and widget sitekey. The response contains the
short-lived token to submit as cf-turnstile-response.
Interactive challenges are handled within the same request.
WAFv3
Provide the challenged URL and set type to
WAFv3. The sitekey is discovered from the challenge. The
response contains cf_clearance, the matching User-Agent, and
the complete cookie jar.
Turnstile request
POST https://api.nullflare.com/
Content-Type: application/json
{
"key": "YOUR_KEY",
"sitekey": "0x4AAAAAAAExampleSitekey",
"host": "https://example.com/login"
}
WAFv3 request
POST https://api.nullflare.com/
Content-Type: application/json
{
"key": "YOUR_KEY",
"type": "WAFv3",
"host": "https://example.com/protected",
"proxy": "http://user:[email protected]:8080"
}
Keep the WAFv3 session together. Use the returned User-Agent, every returned cookie, and the same proxy on the request that follows. A clearance cookie is not portable by itself.
Pricing
API usage is paid in credits: $0.40 per 1,000 credits. The Chrome extension is free.
Turnstile
One token per solve, including interactive challenges.
WAFv3
A clearance runs the interstitial and its embedded Turnstile widget, so it counts as two solves.
Chrome extension
Clicks Turnstile for you in your own browser.
- You pay for results. Credits are used only when a solve returns a token or clearance. Failed solves, rejected requests, rate-limited requests and busy responses are refunded.
- You see your balance. Every response includes the credits left on the key.
- Your key is isolated. Each key has its own simultaneous-solve limit, so other clients' traffic never queues yours.
To buy credits or get a key, email [email protected] or ask on Discord.
Request handling
Per-request proxy
HTTP CONNECT, HTTPS, SOCKS4, and SOCKS5 are accepted. For Turnstile, a rotating proxy or none at all both work. For WAFv3, send the proxy you will use afterwards: the clearance is tied to the address that solved it.
Client isolation
A key that reaches its simultaneous-solve limit receives HTTP 429 without using credits; other clients continue normally.
Responses from the API are always JSON. See the documentation for every field, response, retry rule, and integration example.