Bypass 5 Solver.

Quick Start

reCAPTCHA v2 (cost 10 limit)

GET https://api.chioriya.my.id/api/bypass?action=solve&type=recaptcha-v2&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY

reCAPTCHA v3 (cost 5 limit)

GET https://api.chioriya.my.id/api/bypass?action=solve&type=recaptcha-v3&sitekey=SITEKEY&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY

Cloudflare Turnstile (cost 7 limit)

GET https://api.chioriya.my.id/api/bypass?action=solve&type=turnstile&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY

hCaptcha (cost 12 limit)

GET https://api.chioriya.my.id/api/bypass?action=solve&type=hcaptcha&url=https%3A%2F%2Ftarget.com&geminiApiKey=YOUR_GEMINI_KEY&apikey=YOUR_APIKEY

Cloudflare Challenge (cost 8 limit)

GET https://api.chioriya.my.id/api/bypass?action=solve&type=cloudflare&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY

Endpoint Bypass

Parameter Umum

recaptcha-v2 (cost 10 limit)

Solver memakai Puppeteer headless + @sparticuz/chromium (via lib/browser.js) + VisionFallback (Gemini hardcoded + Qwen guest fallback) untuk image challenge. User tidak perlu kirim credentials vision apa-apa.

recaptcha-v3 (cost 5 limit)

Solver memakai axios langsung ke anchor & reload endpoint Google (tanpa browser).

turnstile (cost 7 limit)

Solver Cloudflare Turnstile memakai Puppeteer. Untuk widget auto, poll window.turnstile.getResponse(). Untuk widget interactive, klik checkbox di iframe challenges.cloudflare.com.

hcaptcha (cost 12 limit)

Solver hCaptcha memakai Puppeteer + VisionFallback (Gemini hardcoded + Qwen guest fallback). Mendukung 3 tipe challenge: image_label_binary (grid 3x3), image_drag_drop (drag dengan bezier trajectory + dynamic delays), dan image_label_area_select (klik normalized coordinate). User tidak perlu kirim credentials vision apa-apa.

cloudflare (cost 8 limit)

Solver Cloudflare challenge (managed / interactive / non-interactive) memakai Puppeteer. Mendeteksi tipe challenge via cType: '...' di HTML, klik checkbox di iframe Cloudflare, lalu ambil cf_clearance cookie. Response berisi cf_clearance, cookies array, cookie_string, dan user_agent siap pakai untuk scraping.

Contoh Pemakaian

GET — recaptcha-v2 inline (URL dengan recaptcha)

fetch("/api/bypass?action=solve&type=recaptcha-v2&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY")
  .then(r => r.json())
  .then(d => console.log(d.token));

GET — recaptcha-v3

fetch("/api/bypass/solve?type=recaptcha-v3&sitekey=6Lc_aCMTAAAAA...&url=https%3A%2F%2Ftarget.com&action=login&apikey=YOUR_APIKEY")
  .then(r => r.json())
  .then(d => console.log(d.token));

GET — turnstile

fetch("/api/bypass/solve?type=turnstile&url=https%3A%2F%2Ftarget.com&apikey=YOUR_APIKEY")
  .then(r => r.json())
  .then(d => console.log(d.token));

GET — hcaptcha dengan sitekey

fetch("/api/bypass/solve?type=hcaptcha&url=https%3A%2F%2Ftarget.com&sitekey=10000000-ffff-ffff-ffff-000000000001&apikey=YOUR_APIKEY")
  .then(r => r.json())
  .then(d => console.log(d.token));

Catatan: geminiApiKey tidak wajib lagi di V9.0.3 — sudah di-hardcode. Cukup kirim url + apikey.

GET — cloudflare (return cf_clearance)

fetch("/api/bypass/solve?type=cloudflare&url=https%3A%2F%2Fnowsecure.nl&apikey=YOUR_APIKEY")
  .then(r => r.json())
  .then(d => console.log(d.cf_clearance, d.cookie_string, d.user_agent));

POST — recaptcha-v2 dengan proxy

const res = await fetch("/api/bypass/solve", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    type: "recaptcha-v2",
    url: "https://target.com",
    sitekey: "6Lc_aCMTAAAAA...",
    proxy: "http://user:pass@proxy.host:8080",
    timeout: 120000,
    maxAttempts: 5,
    apikey: "YOUR_APIKEY"
  })
});
const data = await res.json();
console.log(data.token);

Vision (Gemini + Qwen) sudah di-hardcode, gak perlu kirim Qwen creds apa-apa.

POST — hcaptcha dengan proxy

const res = await fetch("/api/bypass/solve", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    type: "hcaptcha",
    url: "https://target.com",
    proxy: "socks5://user:pass@proxy.host:1080",
    maxAttempts: 5,
    apikey: "YOUR_APIKEY"
  })
});
const data = await res.json();
console.log(data.token);

Vision (Gemini + Qwen) sudah di-hardcode, gak perlu kirim geminiApiKey.

POST — cloudflare dengan proxy + custom UA

const res = await fetch("/api/bypass/solve", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    type: "cloudflare",
    url: "https://nowsecure.nl",
    proxy: "http://user:pass@proxy.host:8080",
    timeout: 45,
    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    apikey: "YOUR_APIKEY"
  })
});
const data = await res.json();
console.log(data.cf_clearance);
console.log(data.cookie_string);
console.log(data.user_agent);

Scraping cross-IP dengan cf_clearance + proxy yang sama

const axios = require("axios");
const HttpsProxyAgent = require("https-proxy-agent");

async function bypassCloudflare(targetUrl, proxyUrl, apiKey) {
  const { data } = await axios.post("https://api.chioriya.my.id/api/bypass/solve", {
    type: "cloudflare",
    url: targetUrl,
    proxy: proxyUrl,
    timeout: 45,
    apikey: apiKey
  });
  if (!data.status) throw new Error(data.message || "Bypass gagal");
  return data;
}

async function scrapeWithProxy(targetUrl, proxyUrl, apiKey) {
  const bypass = await bypassCloudflare(targetUrl, proxyUrl, apiKey);
  const agent = new HttpsProxyAgent(proxyUrl);
  const { data } = await axios.get(bypass.finalUrl || bypass.url, {
    headers: {
      "User-Agent": bypass.user_agent,
      "Cookie": bypass.cookie_string
    },
    httpAgent: agent,
    httpsAgent: agent,
    timeout: 30000,
    proxy: false
  });
  return data;
}

const PROXY = "http://user:pass@proxy-host.example.com:8080";
scrapeWithProxy("https://nowsecure.nl", PROXY, "YOUR_APIKEY").then(console.log);

Struktur Response

Untuk recaptcha-v2 / recaptcha-v3 / turnstile / hcaptcha

Untuk cloudflare (extra fields)

Error Response

{
  "status": false,
  "ok": false,
  "traceId": "bypass_xxx",
  "code": "BYPASS_FAILED",
  "message": "Solver recaptcha-v2 gagal. Limit panel sudah direfund.",
  "type": "recaptcha-v2",
  "cost": 10,
  "result": {
    "success": false,
    "error": "Timeout: g-recaptcha-response tidak terisi",
    "time": 120.001
  },
  "tips": [
    "Pastikan URL target valid dan bisa diakses publik.",
    "Tipe yang didukung: recaptcha-v2 (cost 10), recaptcha-v3 (cost 5), turnstile (cost 7), hcaptcha (cost 12), cloudflare (cost 8).",
    "..."
  ]
}

Perubahan V9.0.1 → V9.0.3

• Vision provider di-hardcode: Gemini API key sudah di-embed di lib/gemini-vision.js. User tidak perlu kirim credentials vision apa-apa untuk recaptcha-v2/hcaptcha.
• Auto-fallback: lib/vision-fallback.js otomatis coba Gemini dulu, kalau rate-limit/error fallback ke Qwen guest mode.
• Module baru: lib/qwen-client.js (extract dari recaptcha-v2-solver), lib/gemini-vision.js, lib/vision-fallback.js.
• UI form di-redesign: tiap tipe punya field group sendiri. Hanya field yang relevan yang muncul. Gak ada lagi field credentials AI yang bikin pusing.
• Field yang dihapus dari UI: qwenToken, qwenEmail, qwenPassword, geminiApiKey, geminiModel. Semua masih accept di API param untuk power user, tapi gak ditampilkan.
• Free tier Gemini: gemini-2.5-flash punya 1500 req/day per API key. Kalau mau lebih, daftar API key baru di Google AI Studio dan override lewat param geminiApiKey atau env GEMINI_API_KEY.
• Semua tipe solver lain (turnstile, cloudflare) tidak berubah.