Authentication

There is no Authorization header and no OAuth flow. Your key travels as the clientKey field in the JSON body of every request, exactly as it does with anti-captcha and CapSolver. That is a compatibility decision, not a security preference.

{
  "clientKey": "sx_live_7Qd2… ",
  "task": { "type": "ReCaptchaV3TokenProxyLess", "…": "…" }
}

Storing the key

Treat the key as a password with a balance attached to it. Anyone holding it can spend your wallet.

• Keep it in an environment variable or a secret manager, never in the repository.
• Never put it in browser JavaScript. A key shipped to the client is a key you have given away — call CaptchAPI from your backend.
• Use a separate key per environment and per service, so revoking one does not stop everything.
• We never log or store the raw key. If you lose it, generate a new one; we cannot recover it for you.

Rotation and revocation

Create the new key first, deploy it, then disable the old one — both work simultaneously, so rotation needs no downtime. Disabling is instant: the next request with that key returns ERROR_KEY_DISABLED.

Restricting a key

Each key can be locked to a list of source IP addresses and to a subset of task types. A key that only ever solves Turnstile from one server should be allowed to do only that — it limits the blast radius if it leaks.

Rate limits

Limits are per key and are generous enough that only a bug should reach them. Exceeding one returns ERROR_RATE_LIMIT with HTTP 200, as with every other error.

• createTask: 120 requests per minute.
• getTaskResult: 10 requests per second.
• getBalance: 60 requests per minute.
• Concurrent in-flight tasks: 100 by default. Ask us if you need more — it is a number, not a plan.

Need a higher concurrency limit for a load test? Tell us in advance and we raise it for the window. Hitting the ceiling unannounced looks like an incident from our side.