Avoid > solve. Almost always.
CAPTCHA-solving is a fallback, not a strategy. The 2024–2026 generation of bot detection (Turnstile, reCAPTCHA v3, AWS WAF) rarely shows a challenge UI; instead, it scores every request continuously on JA4 + IP + behaviour + browser internals. A “CAPTCHA” only appears when the score crosses a threshold. The reliable, cheap, fast path is keeping the score below threshold so no challenge ever fires.
js=true + proxy_type=premium (or residential) + matching proxy_country. On most protected sites this clears below challenge threshold. auto_captcha_solve=true is a safety net with a price: it adds 5 credits to every request that sets it, CAPTCHA or not, and it forces JS rendering. Turn it on only for the sites that need it.The CAPTCHAs you’ll meet
Each major family, what triggers it, and how it gets resolved inside a scraping pipeline.
Default mode is fully invisible. Triggered by JA4 mismatch, IP reputation, or behavioural anomalies. Solved server-side by a real Chromium with patched fingerprint.
Continuous score from 0.0 to 1.0. Most pages pass at ≥0.5; sensitive ones want ≥0.7. No challenge UI shown - purely score-driven.
Click-the-traffic-lights and similar grids. Triggered when v3 score is too low or as a fallback. Outsourced to a vetted human-loop service. Median solve ~12s.
Same flow as reCAPTCHA v2 - image grid, human-loop solve.
JS-execution puzzle plus behavioural checks. Solved server-side by headless Chromium with patched anti-detection. Almost always invisible.
Multi-signal scoring; falls back to a slider/puzzle UI on the borderline cases. Server-side handles the score path; UI path needs human-loop.
Stack of TLS, behavioural, account-history scores. Requires residential IPs plus a clean fingerprint to never trigger. UI fallback is rare but supported.
Drag-the-slider puzzle, common on Chinese-origin sites and some financial portals. Server-side path solves with motion modelling.
How CAPTCHAs get solved
Two outcomes. Either the challenge never needs solving, or it gets solved and you pay a small surcharge.
No challenge shown (no surcharge)
Turnstile, reCAPTCHA v3 and AWS WAF mostly score the request without showing a puzzle. With js=true and a good proxy, the challenge JS runs in our headless browser and the page loads. Nothing is solved, so nothing extra is billed.
CAPTCHA solved (+5 credits a request, typically 20 to 60s)
When a page does show a CAPTCHA and auto_captcha_solve=true is set, it is solved through external solving services. Solves typically take 20 to 60 seconds (cap it with auto_captcha_solve_timeout, in milliseconds, default 120000). Every request that sets auto_captcha_solve=true costs 5 extra credits, whether or not a CAPTCHA was found and solved. Solving forces JS rendering, which also raises the base cost of the call.
js=true + proxy_type=premium (or residential) + matching proxy_country reduces challenge frequency dramatically. Don’t pay for solves you could have prevented with three flags.Monitoring your CAPTCHA spend
The Ujb-Credits response header gives the exact cost of each call, so auto_captcha_solve=true shows up as 5 extra credits on each call that sets it. Log it per target and tune your config where solves pile up. The four metrics below are worth tracking in your own logs.
When NOT to automate CAPTCHAs
We refuse some kinds of CAPTCHA-solving. Not because the technical path is harder, but because the CAPTCHA is doing the job it was designed to do - gating consent, authentication, or rate-limited public goods. Automating past it crosses from data extraction into impersonation.
A CAPTCHA on a login form is the consent gate. Solving it is impersonating the account owner.
Mass signup automation is the canonical abuse case CAPTCHAs were built for. Out of scope.
A challenge before paid content is the merchant gating their own goods. Don’t.
Out of scope, full stop. Not a use case we support at any tier.
Ratchets that depend on one-human-one-vote integrity. Solving the CAPTCHA breaks the protocol.
A CAPTCHA on “contact us” is anti-spam. Don’t solve it to send mass messages.
auto_captcha_solve=false (the default) for a hard bounce on any challenge if your compliance program needs the explicit guardrail. Acceptable-use policy →CAPTCHA-related API parameters
Code examples
Avoid CAPTCHAs in the first place (recommended)
import requests
response = requests.get(
'https://api.ujeebu.com/scrape',
params={
'url': 'https://target-site.com',
'js': 'true',
'proxy_type': 'premium',
'proxy_country': 'US',
},
headers={'ApiKey': 'YOUR_API_KEY'},
)
print(response.text)Auto-solve as a safety net
curl -X GET 'https://api.ujeebu.com/scrape' \
-H 'ApiKey: YOUR_API_KEY' \
-G \
--data-urlencode 'url=https://protected-site.com' \
--data-urlencode 'js=true' \
--data-urlencode 'proxy_type=premium' \
--data-urlencode 'auto_captcha_solve=true'Hard-bounce on any CAPTCHA (compliance mode)
// auto_captcha_solve defaults to false: a challenge is never solved
const res = await fetch('https://api.ujeebu.com/scrape?' + new URLSearchParams({
url: 'https://target.com',
js: 'true',
proxy_type: 'premium',
auto_captcha_solve: 'false',
}), { headers: { ApiKey: 'YOUR_API_KEY' } });
if (!res.ok) {
console.log('blocked or failed with status', res.status);
}FAQ
Often no. Turnstile is usually invisible: use js=true with premium or residential proxies first. auto_captcha_solve=true adds 5 credits to every request that sets it and forces JS rendering, which costs more.
Solving uses external services and typically takes 20 to 60 seconds. You can cap it with auto_captcha_solve_timeout (in milliseconds, default 120000, that is 2 minutes).
Check the Ujb-Credits response header: a request with auto_captcha_solve=true costs 5 credits more than the same request without it, whether or not a CAPTCHA was solved.
Usually one of three things: (a) datacenter IPs on a site that scores IP reputation (try proxy_type=premium or residential), (b) js=false on a JS challenge, or (c) proxy_country not matching the site’s audience. The fingerprinting guide walks through the diagnostic flow.
Cloudflare now scores audio context, deeper plugin enumeration, and a wider canvas variance check. We handle them in the rendering browser when you send js=true, with no extra parameter, and update the patches when vendors change.
Yes. CAPTCHAs on login pages, signup forms, paywalls, banking, KYC, and voting are out of scope. The API returns 422 with a clear refusal message rather than attempting the solve.