Cloudflare Turnstile Protocol Recognition API Integration Instructions

This article will introduce a Cloudflare Turnstile Protocol Recognition API integration guide, which allows users to bypass the recognition and clicking of the Turnstile CAPTCHA, achieving backend automatic decoding by simply submitting the Website Key.

Application Process

To use the Cloudflare Turnstile Protocol Recognition API, first go to the Ace Data Cloud Console to obtain your API Token for future use.

If you are not logged in or registered, you will be automatically redirected to the login page, inviting you to register and log in. After completing this, you will be automatically returned to the current page.

One API Token can call all services on the platform without needing to apply separately for each service. The first application will grant a free quota for a trial experience; when the quota is insufficient, you can recharge the general balance in the console.

📘 Complete documentation: Cloudflare Turnstile Protocol Recognition API →

Basic Usage

First, understand the basic usage method, which is to input the website URL that needs to process the Turnstile CAPTCHA to obtain the processed result. You need to simply pass a website_url field. Our example website is: https://react-turnstile.vercel.app. We need to obtain the website_key from the website_url page. First, open this webpage, press F12 to enter the console, and perform a global search for cf-turnstile in the Element page. You can find the container element that carries the Turnstile, where the string corresponding to data-sitekey is the value of the website_key.

The Request Headers set include:

  • accept: the format of the response result you want to receive, here filled in as application/json, which means JSON format.
  • authorization: the key to call the API, which can be directly selected after application.

Additionally, the Request Body is set, including:

  • website_url: the website URL that needs to process the CAPTCHA.
  • website_key: the website key identifier (sitekey) in Cloudflare Turnstile.
  • action: an optional parameter that only needs to be passed when the target website has set a custom action for the Turnstile component.
  • cdata: an optional parameter that only needs to be passed when the target website has set a custom cData for the Turnstile component.

Click the "Try" button to test, and we get the following result:

{
  "token": "0.mNQ2f9uP6mQ0y3H5Q8bqO7iM......",
  "started_at": "2026-07-24T09:34:13+00:00",
  "finished_at": "2026-07-24T09:34:25+00:00",
  "elapsed": 12.4
}

The returned result has multiple fields, described as follows:

  • token: the verification result after processing the Cloudflare Turnstile CAPTCHA task.
  • started_at, finished_at: the time when this request started processing and produced results (ISO-8601 UTC).
  • elapsed: the total time taken for this processing (seconds).

We can see that we obtained the verification result for processing the Turnstile CAPTCHA, which we can then use for POST or simulate submission to the target website, valid for one-time use with a validity period of 120s, and it is recommended to use it within 60s. When submitting, the token is usually sent as the cf-turnstile-response parameter to the target website. The corresponding Python code to call the token verification is as follows:

import requests

token = '{token}'

data = {
    'cf-turnstile-response': token
}

response = requests.post('https://react-turnstile.vercel.app', data=data)

if response.status_code == 200:
    print(response.text)

If you want to generate the corresponding integration code, you can directly copy it, for example, the CURL code is as follows:

curl -X POST 'https://api.acedata.cloud/captcha/token/turnstile' \
-H 'accept: application/json' \
-H 'authorization: Bearer {token}' \
-H 'content-type: application/json' \
-d '{
  "website_key": "0x4AAAAAAADnPIDROrmt1Wwj",
  "website_url": "https://react-turnstile.vercel.app"
}'

The Python integration code is as follows:

import requests

url = "https://api.acedata.cloud/captcha/token/turnstile"

headers = {
    "accept": "application/json",
    "authorization": "Bearer {token}",
    "content-type": "application/json"
}

payload = {
    "website_key": "0x4AAAAAAADnPIDROrmt1Wwj",
    "website_url": "https://react-turnstile.vercel.app"
}

response = requests.post(url, json=payload, headers=headers)
print(response.text)

Asynchronous Mode (async)

By default, the API is synchronous and blocking: a request will wait until the token processing is complete before returning. If you are doing multi-solver rotation and want to "immediately get the task_id after submitting the task, then schedule other solvers and come back later to get the result," you can pass async: true in the request body.

After passing async: true, the interface will immediately return a task_id without blocking:

{
  "task_id": "61138bb6-19aa-11ec-a9c8-0242ac110002",
  "trace_id": "2efa9340-b21b-4e26-9e14-4aac95f343ab"
}

Then use this task_id to poll POST /captcha/tasks (recommended every 3-5 seconds) to get the result:

curl -X POST 'https://api.acedata.cloud/captcha/tasks' \
-H 'accept: application/json' \
-H 'authorization: Bearer {token}' \
-H 'content-type: application/json' \
-d '{
  "task_id": "61138bb6-19aa-11ec-a9c8-0242ac110002"
}'

During processing, it will return status: processing; when processing is complete, it will return status: ready and the token:

{
  "success": true,
  "task_id": "61138bb6-19aa-11ec-a9c8-0242ac110002",
  "status": "ready",
  "token": "0.mNQ2f9uP6mQ0y3H5Q8bqO7iM......"
}

Billing explanation: In asynchronous mode, creating tasks and polling "processing" are not charged; only when successfully obtaining the token is it charged once (at the same price as synchronous mode). /captcha/tasks is universal for all CAPTCHA interfaces, and you can poll with the same task_id.

Note: Cloudflare Turnstile does not currently support Bring Your Own Proxy, so this interface does not accept the proxy parameter; if passed, it will return 400 invalid_proxy.

Error Handling

When calling the API, if an error occurs, the API will return the corresponding error code and message. For example:

  • 400 token_mismatched: Bad request, possibly due to missing or invalid parameters.
  • 400 invalid_proxy: Bad request, proxy is not supported for this CAPTCHA type.
  • 401 invalid_token: Unauthorized, invalid or missing authorization token.
  • 429 too_many_requests: Too many requests, you have exceeded the rate limit.
  • 500 api_error: Internal server error, something went wrong on the server.

Error Response Example

{
  "success": false,
  "error": {
    "code": "api_error",
    "message": "fetch failed"
  },
  "trace_id": "2cf86e86-22a4-46e1-ac2f-032c0f2a4e89"
}

Conclusion

Through this document, you have learned how to use the Cloudflare Turnstile protocol recognition API to allow users to bypass recognizing and clicking the Turnstile captcha, achieving backend automatic decoding and completing verification simply by submitting the Website Key. We hope this document can help you better integrate and use this API. If you have any questions, please feel free to contact our technical support team.