Turnstile Solver

Base URL

https://80-47-9-18.sslip.io

All requests go over HTTPS. Interactive checks: /health.

Authentication

Every solve request must carry your API key in a header. Requests without it get 401.

X-API-Key: YOUR_API_KEY

Also accepted: Authorization: Bearer YOUR_API_KEY. Keep the key secret — anyone who has it can solve on your quota.

Solve a challenge

POST/v1/turnstile

Request body application/json

Field	Type		Description
`url`	string	required	The page the widget is embedded in, as the browser reports `location.href`.
`sitekey`	string	required	The widget sitekey (starts `0x…`).
`action`	string	optional	The widget's `action`, if the site sets one. Empty by default.
`cdata`	string	optional	Customer data to bind to the token. Empty by default.
`proxy`	string	optional	Upstream proxy URL for this solve. Direct if omitted.

Response

On success, HTTP 200:

{
  "success": true,
  "token": "1.xxxxxxxx…"
}

On failure, HTTP 401 (missing key), 422 (bad body) or 502 (could not solve):

{
  "success": false,
  "message": "Could not solve the Turnstile challenge"
}

The token is single-use and short-lived — submit it promptly and do not log it.

Examples

curl

curl -s https://80-47-9-18.sslip.io/v1/turnstile \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -d '{"url":"https://example.com/login","sitekey":"0x4AAAAAAA…"}'

Python

import requests

r = requests.post(
    "https://80-47-9-18.sslip.io/v1/turnstile",
    headers={"X-API-Key": "YOUR_API_KEY"},
    json={"url": "https://example.com/login",
          "sitekey": "0x4AAAAAAA..."},
    timeout=120,
)
token = r.json()["token"]

Node

const r = await fetch("https://80-47-9-18.sslip.io/v1/turnstile", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": "YOUR_API_KEY",
  },
  body: JSON.stringify({
    url: "https://example.com/login",
    sitekey: "0x4AAAAAAA...",
  }),
});
const { token } = await r.json();

Managed widgets (those that show a checkbox) go through an extra step and fail intermittently on a single try; the service retries up to three times automatically, so a normal call returns a token ~99.8% of the time. Invisible widgets succeed first try.

Health

GET/health — public, no key. Returns 200 with a small JSON body while the service is up.

Performance

~13,500/min

invisible widgets, sustained

~10,900/min

managed widgets, sustained

~0.9–1.1 s

median solve time

99.8–100%

success rate

Drive it with a connection-reusing client and keep several hundred requests in flight for peak throughput; a handful in flight for lowest latency.