Authentication

SolverCF uses a single API key called clientKey, used the same way across every endpoint (including the temporary email endpoints). You'll find it on your Dashboard.

Every request is authenticated by including the key in the JSON body — there is no Authorization header, no API version header, and no request signing. Every endpoint accepts clientKey as a plain top-level field:

{
  "clientKey": "YOUR_CLIENT_KEY",
  "task": { "...": "..." }
}

Because authentication lives in the body rather than a header, clientKey is required on every single call, including read-only ones like Get Balance — there's no separate "session" or token exchange step.

Calling the API from a browser

CORS is fully open (Access-Control-Allow-Origin: *) on the captcha-solving endpoints, so fetch()/XMLHttpRequest calls work directly from browser-side JavaScript without a backend proxy. This is convenient for browser extensions and client-side tooling, but it also means:

Never embed a real clientKey in code that ships to end users (a public website, a browser extension distributed to others, a mobile app). Anyone can read it out of the request and spend your balance. Browser-side calls are fine for your own tooling running under your control — not for anything you distribute.

Keep it secret

• Never commit your clientKey to source control or expose it in client-side/browser code you distribute to others.
• Store it in an environment variable or secrets manager.
• If you believe your key has leaked, rotate it from the Dashboard immediately — a leaked key lets anyone spend your balance and see your task history. The old key stops working the moment you rotate.

Common authentication errors

Checking your balance

Use Get Balance at any time to confirm your key is valid and see your remaining balance without spending anything — it's a good first call to make when wiring up a new integration.