API referenceTask typesAWS WAF

AWS WAF

The Amazon bot control challenge, the one that shows a puzzle or a toy game before it hands over a token. The answer is a cookie you attach to the session.

Task types

Type string	Proxy	Use it for
`AntiAwsWafTaskProxyLess`	None	The ordinary case.
`AntiAwsWafTask`	Yours	Rule sets configured to bind the token to an address.

Task object

Two fields are always required, and proxy is a third on AntiAwsWafTask. Everything after that lets you hand over what you already scraped off the challenge page, which makes the solve quicker and more reliable. Send what you have and leave out what you do not.

Field	Type	Required	What it is
`type`	String	Yes	One of the two above.
`websiteURL`	String	Yes	The address that served the challenge.
`proxy`	String	On `AntiAwsWafTask`	The type without the ProxyLess suffix requires one, in either shape.
`awsKey`	String	No	The `key` value on the challenge page.
`awsIv`	String	No	The `iv` value.
`awsContext`	String	No	The `context` value.
`awsChallengeJS`	String	No	The address of `challenge.js`.
`awsApiJs`	String	No	The address of `jsapi.js`.
`awsProblemUrl`	String	No	The problem endpoint, the one carrying `num_solutions_required`.
`awsApiKey`	String	No	The `api_key` returned by the problem endpoint.
`awsExistingToken`	String	No	A previous `aws-waf-token`, when the site asks you to verify a second time.

Example

POST/createTask

{
  "clientKey": "YOUR_API_KEY",
  "task": {
    "type": "AntiAwsWafTaskProxyLess",
    "websiteURL": "https://example.com/checkout",
    "awsKey": "AQIDAHjcYu/GjX+QlghicBg...shMIKvZswZemrVVqA==",
    "awsIv": "CgAAFDIlckAAAAid",
    "awsContext": "7DhQfG5CmoY90ZdxdHCi8WtJ3z...njNKULdcUUVEtxTk=",
    "awsChallengeJS": "https://41bcdd4fb3cb.610cd090.us-east-1.token.awswaf.com/41bcdd4fb/challenge.js"
  }
}

JSON

{
  "errorId": 0,
  "taskId": "646825ef-9547-4a29-9a05-50a6265f9d8a",
  "status": "ready",
  "solution": {
    "cookie": "223d1f60-0e9f-4238-ac0a-e766b15a778e:EQoAf0APpGIKAAAA:AJam3OWpff1VgKIJ..."
  }
}

Solution field	What to do with it
`cookie`	Set it as `aws-waf-token` on the session and repeat the request.

Finding the challenge values

Request the protected page and keep the response even when it is a 405 or a 202. The challenge ships inside it.
Search the body for window.gokuProps. The key, iv and context values sit there.
The challenge.js address is the script tag on the same page, under a token.awswaf.com host.

Last updated 21 September 2026