CloudflareJsdCookie
Solve Cloudflare's silent JSD sensor. Send a URL and a proxy, get back cf_clearance to replay on the protected origin.
Cloudflare's JSD sensor is invisible. There is no "Just a moment…" page and nothing to click - the protected page serves its content straight away, while a script Cloudflare injects alongside it fingerprints the browser and posts the result to a one-shot endpoint. Cloudflare answers that post with cf_clearance, and later requests are judged on whether you have it.
CloudflareJsdCookie runs that sensor in a real browser and returns the cookie jar it earns.
You supply a URL and a proxy. Everything the sensor needs - the one-shot URL, the ray, the timestamp, the script and its payload format - is read from a live load of the page. A userAgent is optional, and so is the page itself if you already have it (see below).
Replay with the same UA and exit IP
Cloudflare binds cf_clearance to the exit IP and the user agent that earned it. Replay it through the same
proxy you submitted, sending the userAgent from the response. A mismatch is re-challenged as though you had
no cookie at all.
Is the site actually using JSD?
This is the one thing worth checking before you send a task, because JSD leaves no visible trace. Open the site in a normal browser with devtools on the Network tab and filter for challenge-platform. A JSD site makes two requests you can see:
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/<hash>/main.js
POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/<hash>/<stamp>The POST .../jsd/oneshot/... is the sensor submitting itself, and its response sets cf_clearance. If you see it, this is the right task.
You can also check from the console before the script clears it:
window['__CF$cv$params']; // { r: '<ray>', t: '<base64 timestamp>', ... }If instead you land on an interstitial that says "Just a moment…", or you are asked to tick a checkbox, that is a managed or interactive challenge - use CloudflareChallengeCookie for those. And if the page embeds a visible Turnstile widget you need a token for, use TurnstileToken.
Saving the page fetch (htmlPageBase64)
The solve loads the target page so the sensor has something to run in, and on a real site that page is by far the largest thing it pulls - Discord's is ~168 KB, against a few KB for the sensor script and its post. Everything else is blocked.
If you already fetched the page, send it as htmlPageBase64 and the solver serves yours instead of fetching it again. The sensor still runs, and still posts from the solve's own exit, so the clearance is unchanged.
import base64, requests
page = requests.get('https://discord.com/', proxies=proxies).text
payload = base64.b64encode(page.encode()).decode()The capture has to still carry __CF$cv$params
That is where the sensor reads its ray and timestamp. A page saved out of a browser session after the script ran has already had them removed, and is rejected up front rather than after a worker has spent an attempt on it.
Age is not the problem it looks like: a capture solved just as reliably at ten minutes old as fresh in testing. Beyond that is untested, so treat ten minutes as the supported window rather than a measured limit.
It is optional and worth skipping unless you already have the page: fetching it yourself just to pass it in costs the same bandwidth it saves.
Why there is no one-shot URL parameter
The one-shot URL looks like a stable value worth passing in, and it is not:
/cdn-cgi/challenge-platform/h/g/jsd/oneshot/f70cb37711aa/0.5513397598889318:1785718830:JaAvdn…Everything after the script hash is minted per page load - a random component, the issuing timestamp, and a signature tied to the ray of the request that served the page. One captured by hand is stale by the time it reaches the API, and it is bound to a load that happened from a different IP than the solve. The only way to obtain a usable one is to load the page, which is what the task does.
The same is true of r and t from __CF$cv$params. There is nothing to extract by hand.
Choosing the URL
Use a page that actually serves the sensor. On most sites that is the homepage, but the sensor is applied per route, so if a solve comes back saying the target served no JSD sensor, open the route you actually care about and check the network tab for the oneshot post described above.
Proxy
A proxy is required, because clearance is only worth having if it is bound to the address you will use it from. Supported schemes are http, https and socks5. Residential and mobile exits are scored far more generously than datacenter ranges.
Cookies expire
cf_clearance typically lasts from around thirty minutes to a few hours, and Cloudflare can invalidate it earlier -
for example when your request rate or path pattern changes sharply. When the origin starts challenging you again,
solve once more for a fresh cookie.
Why a browser rather than a rebuilt payload
Open-source JSD solvers rebuild the sensor payload in native code: they download the script, deobfuscate it to recover its compression alphabet and payload schema, and construct the fingerprint by hand. It is fast, and it carries two costs their own authors document - Cloudflare rotating the script breaks the deobfuscator until someone updates it, and sites that check the TLS fingerprint reject the resulting clearance outright.
This task runs the real sensor in a browser whose fingerprint, user agent and TLS handshake already agree with each other. A script rotation changes nothing, and the clearance holds on sites that inspect the handshake.
Supported Providers
| Provider | Price per 1,000 | Routing |
|---|---|---|
 | $0.01 |
Request Schema
| Field | Type | Required | Description |
|---|---|---|---|
clientKey* | string | Yes | Your API key. Create one in the AnySolver dashboard. Example: |
task* | object | Yes | The task body. Required fields depend on the task type. See Tasks for per-task schemas. View task properties |
settings | object | No | Per-request settings for routing, auto retry, auto fallback, and proxy behavior. See Routing Strategies. |
provider | No | Specific provider to use. If omitted, automatic routing selects the best provider. Example: | |
selectionMode | No | Routing strategy for this request. Overrides the API key default. See Routing Strategies. Example: | |
keyPoolMode | No | Which provider key pool to use: Example: |
Task Object Properties
The task field accepts an object with the following properties:
| Field | Type | Required | Description |
|---|---|---|---|
type* | Yes | ||
websiteURL* | URL | Yes | The page protected by the JSD sensor. This is the only parameter the challenge needs: the one-shot URL, ray and timestamp are all read from a live load of this page. Example: |
proxy* | string | object | Yes | |
userAgent | string | No | Browser User-Agent string. Must match the browser used on the target page. Not all providers properly support this parameter. Verify the compatibility with the provider you are using. Example: |
htmlPageBase64 | string | No | Optional. The protected page, base64-encoded, if you already fetched it. Served to the solver in place of fetching it again, which removes the largest transfer from the solve. It must still contain __CF$cv$params. Example: |
Optional fields are not guaranteed across providers
Response Schema
| Field | Type | Required | Description |
|---|---|---|---|
status* | Yes | Task status: "processing", "ready", or "failed". Example: | |
errorId* | Yes | 0 = success, 1 = external error, 2 = internal error. Example: | |
taskId | string | No | Unique identifier returned when the task was created. Example: |
errorCode | No | Machine-readable error code. Example: | |
errorDescription | string | No | Human-readable error message with resolution hints. Example: |
cost | number | No | Actual cost charged for this task in USD. Example: |
taskType | No | The type of CAPTCHA task to solve. Example: | |
provider | No | Specific provider to use. If omitted, automatic routing selects the best provider. Example: | |
solution | object | No |
Solution Object Properties
The solution field contains an object with the following properties:
| Field | Type | Required | Description |
|---|---|---|---|
cookies* | Record<string, unknown> | Yes | Cleared session cookies, including cf_clearance, to replay on the target. Example: |
userAgent* | string | Yes | User-Agent string used during solving (if applicable). Example: |
raw* | Record<string, unknown> | Yes | Raw provider response data for advanced use cases. |