Bypass Akamai Bot Manager with a single API call
Generate valid _abck cookies and sensor data over plain HTTP, no headless browsers, no browser farms, just the payloads Akamai expects.
from hyper_sdk import Session
session = Session(api_key="your-api-key")
# Akamai needs around 3 sensor posts before _abck is trusted
for _ in range(3):
sensor = session.generate_sensor_data(
page_url="https://www.target.com/checkout",
user_agent=ua,
abck=abck,
bmsz=bmsz,
version="3",
)
response = client.post(script_url, data=sensor.payload)
abck = response.cookies["_abck"]What is Akamai Bot Manager?
Akamai Bot Manager is one of the most widely deployed anti-bot systems on the web, protecting checkout, login and inventory endpoints on major retail, travel and finance sites. It demands proof that a real browser executed its sensor script before it will trust a request.
Why it's hard to bypass
Bot Manager doesn't rely on a single check. It layers signals across the network stack and the JavaScript runtime, then scores them together. Defeating one mechanism isn't enough, the payload has to satisfy all of them at once, and the rules change frequently.
That's why teams reach for headless browsers, and why those break constantly. Our API reproduces every signal correctly from a single HTTP call.
Dynamic script endpoints
The sensor script path rotates per page load. The SDK parses the protocol page before sensor generation starts.
_abck cookie validation
Akamai issues an _abck cookie that only turns valid after correctly formed sensor payloads are posted back.
TLS fingerprinting
JA3/JA4 handshakes are matched against known browser profiles. A mismatched client is flagged instantly.
Header order analysis
Header names, casing, and ordering are inspected. Most HTTP libraries betray automation here.
JavaScript environment checks
The script probes navigator, screen, timing, and event entropy to confirm a real browser executed it.
Headless browsers & Puppeteer
One unified API call
Every Akamai challenge, one API
Select a challenge type to see what it is, when it fires, and exactly how we resolve it.
Sensor Data
Core challengePOST /v2/sensorThe baseline Akamai check. Every protected page loads a sensor script that collects device, timing, and entropy signals, then expects an encrypted sensor_data payload posted back.
Issued on virtually every Akamai-protected endpoint. Your first request usually returns an invalid _abck cookie until valid sensor data is submitted.
Akamai needs around three sensor posts before the _abck cookie is trusted. Our API returns each sensor_data payload in sub-10ms; you POST them to the target and the server sets the valid _abck and bm_sz cookies itself.
for _ in range(3):
sensor = session.generate_sensor_data(
page_url=url, user_agent=ua, abck=abck, bmsz=bmsz,
)
abck = post(script_url, sensor.payload).cookies["_abck"]
# _abck now valid, set by the serverpayloadcontextFrom blocked to valid _abck, in one API flow.
You stay in control of every request to the target: your proxies, your session, your cookie jar. We do one thing, turn the sensor challenge into a valid payload. Here's the real Akamai flow:
Request the protocol page
Hit the target. Akamai serves the sensor script reference and an untrusted _abck cookie. The SDK parses the rotating script path for you.
session.parse_script_path(html)Generate sensor data via our API
Send the page context. We return the sensor payload in sub-10ms, usually three times before Akamai trusts the cookie.
session.generate_sensor_data(...)POST it, keep the cookie, proceed
POST each payload to the target. The server sets the valid _abck and bm_sz itself. Reuse them on your real request, you're through.
POST payload -> _abck validWhy an API and not a headless browser.
Puppeteer and Playwright are good general tools. They are not built for the volume and freshness Akamai work demands.
Pay for sensors, not browsers
One account covers Akamai, Kasada, DataDome and Incapsula. Start with a free week, stay self-serve at a flat €3 / 1k, or move to a monthly bundle for a lower per-sensor rate.
Self-serve. Top up a balance and pay only for the sensors you generate.
A monthly sensor bundle with the best per-sensor rate. Pick the volume that fits.
Committed-use volume pricing with a direct line to the founding team.
Outputs & example payloads
What the API returns, what the target server sets, and exactly what a sensor request and response look like on the wire.
payloadAPI outputThe sensor data the API returns. POST it to the target on each sensor call.
_abckserver-setSet by the target server, not the API. Turns valid after ~3 sensor posts. Pass the current value back in as context on every call.
bm_szserver-setBootstrap cookie set by the target server. Read it from responses and pass it back as context.
scriptUrlparsedThe dynamic sensor-script URL, parsed from the protocol page by the SDK. Rotates per page load.
userAgentyou provideThe user-agent the sensor is fingerprinted against. Keep it identical on every call and on your real request.
ipyou provideThe egress IP the payload is generated for. Must match your request exit IP.
POST https://akm.hypersolutions.co/v2/sensor
{
"pageUrl": "https://www.target.com/checkout",
"version": "3",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
"abck": "9C2A...~-1~-1",
"bmsz": "8FH2D1...",
"scriptUrl": "https://www.target.com/_bm/_data",
"ip": "203.0.113.10",
"acceptLanguage": "en-US,en;q=0.9",
"context": ""
}In your language.
MIT-licensed, on npm / PyPI / GitHub. Challenge parsing, cookie validation, and payload generation in every SDK, or skip them and hit the HTTP API directly.
npm i hyper-sdk-jspip install hyper-sdkgo get github.com/Hyper-Solutions/hyper-sdk-go/v2Akamai bypass questions
Anything not covered here, including whether your exact target is supported, gets a faster answer in Discord than anywhere else.
Ask in DiscordReady to bypass Akamai Bot Manager?
Create an account and your free week starts immediately. Point it at your hardest Akamai target and benchmark it yourself.