Kasada · KPSDK
Bypass Kasada with a single API call
Send us the ips.js the block page hands you and take back the eight x-kpsdk-* headers and the enciphered /tl payload, ready to post yourself. Proof of work for every request after that is unlimited and free.
Beta - invite only
# send the sensor script, get the headers and payload back $ curl -s https://ksd.antibotapi.com/tl \ -H "x-api-key: $KEY" -H "content-type: application/json" \ -d @sensor.json { "headers": { "x-kpsdk-ct": "…", … }, "payload": "…" } # you POST it to the site
The challenge
What Kasada puts in your way
Kasada is two obstacles, not one. There is a payload to earn a session with, and then a cost attached to every single request you make with it.
The block page links a freshly generated ips.js. Its query string carries the session token, the SDK version and the manifest.
The sensor bundles the machine it claims to be into an enciphered body and posts it. That exchange is what mints the session.
Each protected request carries its own answer, salted per site. We hand them out free, however many you need.
The payload and the request that carries it have to tell the same story: the user agent you send, the language you claim and the address you send from all appear inside the body. A correct payload from the wrong client is still a block.
Why it's hard
Every copy of the script is different
There is no build to reverse once and reuse. ips.js is generated per request, so the handler has to be recovered from the script actually in front of you, and the key that enciphers the payload comes out of that same script. On top of that the body has to describe a machine that holds together - platform, screen, GPU, fonts, timezone, language - because a payload claiming a Windows desktop while the request says otherwise is a contradiction the sensor gets for free. The proof of work is then salted per site, so answers minted for one host are the right shape, the right size, and refused by the next. Run the real thing instead and you are back to a browser farm executing that script for every session, and rebuilding it on every rotation.
How it works
You keep the socket, we do the maths
The blocked response serves a page linking ips.js, with KP_UIDz, x-kpsdk-v and x-kpsdk-im in its query string.
Fetch that URL and base64-encode the script it returns. Keep the link: three of the headers come out of it.
POST the script, the link, your user agent and your Accept-Language to /tl. Back come the headers and the payload.
Decode the payload, POST it to the site as application/octet-stream, then take one /cd per protected request.
curl -X POST https://ksd.antibotapi.com/tl \ -H "x-api-key: YOUR_API_KEY" \ -H "content-type: application/json" \ -d '{ "ips_link": "https://www.example.com/ips.js?KP_UIDz=…&x-kpsdk-v=j-1.2.587", "script": "<base64 of ips.js>", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) … Chrome/146.0.0.0 Safari/537.36", "accept_language": "en-GB,en;q=0.9", "page_url": "https://www.example.com/", "ip": "<the proxy IP you will post from>" }'
Then one call per protected request for the proof of work, quoting the clock /tl answered with and the newest session token. It is the same key, and it is never billed.
curl -X POST https://ksd.antibotapi.com/cd \ -H "x-api-key: YOUR_API_KEY" -H "content-type: application/json" \ -d '{ "st": 1770000000000, "ct": "<latest x-kpsdk-ct>", "domain": "www.example.com" }' { "payload": "…" } # send it as x-kpsdk-cd
Chrome on Windows user agents only, and the site has to be one we cover. Full reference in the Kasada docs.
API vs browser automation
One HTTP call, not a browser farm
| DISASM API | Headless browser | |
|---|---|---|
| Per session | One HTTP request, solved in the response | Full page load, then the sensor's own work |
| Per request | A free proof-of-work call | The page re-runs the work for you, at page cost |
| Network | We never touch the target; you keep the socket | The browser is the client, proxies and all |
| Infrastructure | An HTTP client, nothing else | A browser fleet, RAM and CPU per worker |
| Maintenance | We track every script rotation | You re-tune on every rotation |
| Detection | Native payload, no automation leaks | webdriver, CDP traces, fingerprint gaps |
Pricing
Proof of work is free. Pay for payloads.
A solve is one payload - one POST /tl. The x-kpsdk-cd answer that every protected request needs afterwards is unmetered on every tier, including the beta. Other vendors bill that work out of the same quota as the payload, so on a site that challenges every request their number is not the number you pay. Prices exclude VAT.
Past 2 million solves a month we price it directly, from £0.85 per 1,000 - talk to us. Also on the API: DataDome bypass and Incapsula bypass, both open to everyone.
FAQ
Kasada bypass questions
What is Kasada, and what is KPSDK?+
KPSDK is the client half of Kasada's bot defence. A blocked response serves a page that links ips.js; the sensor runs, posts an enciphered payload to /tl, and from then on every request to a protected endpoint carries proof-of-work headers. Miss either half and you are still blocked.
What do I send, and what do I get back?+
You fetch the ips.js the block page links and POST it to us with that link, the user agent you will send and your Accept-Language. Back come the eight x-kpsdk headers and the /tl payload as base64. You decode the payload and POST it to the site yourself.
Do you connect to the target site?+
No. We compute and never open a socket to the target, so every request to the site is made by you, from your own address and proxies. That is also why we ask which address you will post from: the payload states a timezone and the request carrying it has to agree.
Is the proof of work billed?+
No. A solve is one payload, which is one POST /tl. The x-kpsdk-cd proof of work is a separate call, it is unlimited, and it is never metered on any tier including the beta. On a site that challenges every request, that is the difference between paying once and paying per page.
Do I need a headless browser?+
No. It is a plain HTTPS endpoint with a JSON body, so any language with an HTTP client works. Nothing runs Kasada's JavaScript on your side, so there is no browser fleet to host and no automation surface to leak.
Which user agents are supported?+
Chrome on Windows. The device data a payload draws from - platform, screen, GPU, fonts - all describes Windows machines, so a payload sent under any other user agent contradicts itself.
What does it cost?+
Packages run from £45 a month for 25,000 solves to £1,000 a month for 1,000,000, and above 2 million we price it directly from £0.85 per 1,000. Pay as you go is £2.20 per 1,000 solves when it opens at general availability. Proof of work is free on all of them.
Ready to bypass Kasada?
Tell us what you are pointing it at and we will get you a key. The beta starts with 10,000 free solves and unlimited proof of work.