Bypass Kasada Protection with a single API call
Generate valid /tl payloads, proof of work values, and Vercel BotID headers, all via simple API calls, no browser.
from hyper_sdk import Session, KasadaPayloadInput
session = Session(api_key="your-api-key")
# Parse the 429 challenge, generate the /tl payload
result = session.generate_kasada_payload(
KasadaPayloadInput(
script=kasada_script,
ips_link=ips_link,
user_agent=ua,
ip=proxy_ip,
accept_language="en-US,en;q=0.9",
)
)
tl_response = client.post(
"https://www.target.com/tl",
data=result.payload,
headers=result.headers,
)
# read x-kpsdk-st and x-kpsdk-ct, then generate cdWhat is Kasada protection?
Kasada is an advanced anti-bot system built around heavy client-side JavaScript and per-request proof of work. It fingerprints the runtime, demands signed x-kpsdk tokens, and re-challenges constantly.
Why it's hard to bypass
Kasada combines an obfuscated VM-style script with proof of work that changes on every request. Re-implementing it by hand breaks the moment Kasada ships a new build, and running the real script needs a full browser: slow, heavy and easy to fingerprint.
Our API generates the /tl payload, the x-kpsdk-cd proof of work value, and the BotID x-is-human value from simple HTTP calls. You send the script and session context, we return what you need.
429 initial challenge
The first request returns a 429 carrying the ips.js script. Nothing works until you execute and post a valid payload.
x-kpsdk-ct token
Kasada expects a signed token. Missing, stale, or incorrectly bound tokens are rejected.
Proof of work
Protected requests need a fresh x-kpsdk-cd proof of work value computed from the current challenge.
TLS & header-order validation
JA3/JA4 and header ordering are checked alongside the JavaScript proof.
Headless browsers & Puppeteer
One unified API call
Every Kasada challenge, one API
Select a challenge type to see what it is, when it fires, and exactly how we resolve it.
Payload Generation
CorePOST /payloadThe core Kasada flow. The first request returns a 429 carrying the script and IPS link; Kasada expects a valid payload posted to /tl before it trusts you.
On the first request to any Kasada-protected route, the 429 with a script reference and IPS link is the tell.
Send userAgent, script, ipsLink, ip and acceptLanguage to the API. We return the payload and headers for the target /tl POST.
result = session.generate_kasada_payload(
KasadaPayloadInput(
user_agent=ua,
script=kasada_script,
ips_link=ips_link,
ip=proxy_ip,
accept_language="en-US,en;q=0.9",
)
)
client.post("/tl", data=result.payload, headers=result.headers)payloadheadersHow the bypass works
Generate the /tl payload first, then generate proof of work whenever a protected request needs a fresh x-kpsdk-cd. Most developers integrate in under 30 minutes.
Resolve the 429 challenge
Make the initial request and receive a 429 response carrying the script reference and IPS link.
GET target -> 429 + ipsLinkFetch the script
Parse the page for the script path, keep the ipsLink, and fetch the obfuscated JavaScript challenge content.
session.parse_kasada_script_path(html)Generate payload via our API
Send userAgent, script, ipsLink, ip and acceptLanguage to /payload. It returns the target /tl payload and headers.
session.generate_kasada_payload(...)POST to /tl and generate cd
Submit the payload to /tl, read x-kpsdk-st and x-kpsdk-ct, then call /cd for a fresh x-kpsdk-cd value.
POST /tl -> POST /cdAPI vs browser automation
Headless browsers can technically run Kasada's VM until the next build, or until proof of work overhead crushes throughput. Here's how a managed API compares on the metrics teams actually feel.
Pay for requests, not browsers
One account covers Akamai, Kasada, DataDome and Incapsula. Start self-serve, then move to a monthly bundle for a lower per-request rate. Every challenge type is included on every plan.
Self-serve. Top up a balance and pay only for the requests you generate.
A monthly request bundle with the best per-request rate. Pick the volume that fits.
Committed-use volume pricing with a direct line to the founding team.
Outputs & example payloads
What the API returns, what the target server validates, and exactly what a Kasada token request and response look like on the wire.
userAgentyou provideThe browser user-agent used for the target request and payload submission.
scriptyou provideThe Kasada script content fetched from the target page.
ipsLinkparsedThe IPS link obtained from the Kasada block page. Required for /payload.
ipyou provideThe IP used to post sensor data to the target site. It must match the target request egress IP.
acceptLanguageyou provideThe Accept-Language header from the same session.
stserver-setTimestamp from the x-kpsdk-st response header of the /tl request. Required for /cd.
ctserver-setValue from the x-kpsdk-ct response header of the /tl request. Required for /cd.
domainyou provideThe domain of the p.js URL. Required for /cd.
workTimeoptionalCustom workTime value when generating proof of work in advance.
fcoptionalOnly used on specific sites that make a GET request to /mfc.
POST https://kasada.hypersolutions.co/payload
{
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
"script": "function ...",
"ipsLink": "https://www.target.com/ips.js?...",
"ip": "203.0.113.10",
"acceptLanguage": "en-US,en;q=0.9"
}In your language.
MIT-licensed, on npm / PyPI / GitHub. Challenge parsing, payload generation, proof of work, and BotID support in every SDK, or skip them and hit the HTTP API directly.
npm i hyper-sdk-jspip install hyper-sdkgo get github.com/Hyper-Solutions/hyper-sdk-go/v2Kasada bypass questions
Anything not covered here, including whether your exact target is supported, gets a faster answer in Discord than anywhere else.
Ask in DiscordReady to bypass Kasada protection?
Drop in an official SDK and clear your first challenge in minutes. Pay-as-you-go to start, with subscription bundles when you scale.