The API, end to end.

01Overview

OllieSolver is a hosted HTTP API that turns anti-bot challenges into usable tokens. Real browser sessions for interactive walls, vision models for image challenges, and pure computation for proof-of-work. One endpoint, one response shape, fifty challenge types.

We run the browsers, the models, and the egress. You send JSON with your key and get a token, cookie, or answer back. There is no SDK to install and no infrastructure to babysit.

02Quick start

Create an account with Google or email/password, then generate a key in your dashboard. Once the solver API launches, set the authorization header and make one call. Keys look like ok_live_… and are tied to nothing more than fair-use capacity — no project setup, no billing profile.

$ curl -s https://api.olliesolver.lol/solve \
    -H 'Authorization: Bearer ok_live_…' \
    -H 'Content-Type: application/json' \
    -d '{"type":"cloudflare","url":"https://nowsecure.nl/"}'

{
  "type": "cloudflare",
  "solved": true,
  "cf_clearance": { "value": "X0ujw…" },
  "user_agent": "Mozilla/5.0 …"
}

Need a different runtime? The request is plain JSON over HTTPS; anything with an HTTP client works. Check service health without a key:

$ curl -s https://api.olliesolver.lol/health
{"status":"ok"}

03Authentication

Every solve uses a bearer key. There are no seats, projects, or rotating client secrets — one key, one header.

Authorization: Bearer ok_live_…
Content-Type: application/json

Keep the key server-side. Do not ship it in a browser bundle, a mobile binary, or a public repo. If a key leaks, rotate or revoke it in your dashboard. The full key is only shown once; only its SHA-256 hash is stored.

04Solve endpoint

POST /solve accepts a JSON body and returns the token, cookie, or answer for one challenge. Requests are synchronous: the connection stays open while the challenge is worked, typically for a few seconds.

Request fields

Extra fields are allowed when a challenge needs them. If a required input is missing, the API returns 422 with a message naming the field instead of guessing.

Cloudflare interstitial

$ curl -s https://api.olliesolver.lol/solve \\
    -H 'Authorization: Bearer ok_live_…' \\
    -H 'Content-Type: application/json' \\
    -d '{"type":"cloudflare","url":"https://nowsecure.nl/"}'

Turnstile widget

$ curl -s https://api.olliesolver.lol/solve \\
    -H 'Authorization: Bearer ok_live_…' \\
    -H 'Content-Type: application/json' \\
    -d '{"type":"turnstile",
         "url":"https://example.com/login",
         "sitekey":"0x4AAA…"}'

Image challenge

import base64, httpx

image = base64.b64encode(open("grid.png", "rb").read()).decode()

r = httpx.post(
    "https://api.olliesolver.lol/solve",
    headers={"Authorization": "Bearer ok_live_…"},
    json={"type": "grid", "image_b64": image},
    timeout=90,
)
print(r.json())

05Responses

Successful solves return 200 with a JSON object. Every response includes type and solved; the rest of the envelope depends on the challenge.

Common shapes

{
  "type": "cloudflare",
  "solved": true,
  "elapsed": 1.84,
  "cf_clearance": {
    "value": "X0ujw…",
    "expires": 1790000000
  },
  "user_agent": "Mozilla/5.0 …"
}

{
  "type": "turnstile",
  "solved": true,
  "token": "0.abc123…",
  "user_agent": "Mozilla/5.0 …"
}

{
  "type": "image_to_text",
  "solved": true,
  "text": "X7K2P"
}

06Challenge types

Fifty types across four families. Thirty-two are verified live; the rest need a real sitekey, URL, or image before they can run. The type value is the API contract — names are lowercase and stable.

Tags marked IP-sensitive depend on the network the request leaves from. See Egress & IP for how we handle them.

07Errors

Errors use standard HTTP status codes and a JSON body with a detail string. Log the code and the detail; don't retry a request that will fail the same way again.

HTTP/1.1 422 Unprocessable Entity

{
  "detail": "sitekey is required for turnstile"
}

Retry 429 and 500 with exponential backoff and jitter. Do not retry 400, 401, 403, or 422 unchanged — fix the request first.

08Egress & IP

There is no proxy pool to configure, no IP list to rotate, and no browser fleet to tune. Requests leave through managed egress, and the network class is chosen per challenge type.

Managed by default

Cloudflare, Turnstile, reCAPTCHA, hCaptcha, and the proof-of-work types work over standard egress. You do not need to supply a proxy for them.

IP-sensitive types

Akamai and DataDome score the network independently of the browser. We route those through residential or mobile egress where support is available. If a target is not supported on the current egress, the API returns 403 rather than burning requests you cannot use.

Working on a target that is especially picky? Tell us the type and region and we will look at whether it is reachable.

URL safety

Only public HTTP and HTTPS targets are accepted. Loopback, link-local, and private-range URLs are rejected with 422, so the solver cannot be used to probe an internal network.

09Limits & fair use

OllieSolver is free to use. There is no trial timer, no credit card, no per-solve invoice, and no paid tier hiding behind a limit. Fair-use rules keep the shared service healthy.

What fair use looks like

• Request rate. A generous per-key rate for normal application traffic.
• Concurrency. A cap on simultaneous jobs per key. Extra jobs wait in the queue rather than failing immediately.
• Spikes. During busy periods you may receive 429 with a Retry-After header. Back off and retry.
• No metering. There is no per-solve price and no token markup. Fair use is about capacity, not billing.

Abuse

Keys are for the project they were issued for. Credential stuffing, fraud, spam, scraping at abusive volume, and attempts to use the service against targets you do not control are grounds for revocation without notice.

10Responsible use

OllieSolver solves anti-bot challenges. That is a capability, and capabilities cut both ways. Use it for testing, accessibility research, monitoring your own properties, and workflows you are authorized to run.

• Only target sites you own or have explicit permission to test.
• Respect each target's terms of service and applicable law.
• Do not use the service for fraud, credential stuffing, spam, or evading a ban for abusive behavior.
• Do not resell raw access to the API without an agreement.
• Keep tokens and keys secret; they are capabilities, not public data.

We may suspend a key that breaks these rules. If something is ambiguous, ask from your account first.