Camoufox and Cloudflare Turnstile
Camoufox takes an approach the Python stealth libraries cannot: it is a Firefox fork that intercepts fingerprint data at the C++ implementation level, so the changes are not visible to JavaScript inspection the way a patched property is. That is a genuinely different position. What it does not include is a Turnstile solver — the issue requesting one was closed as not planned, and the closing comment named hCaptcha and reCAPTCHA as future work without mentioning Turnstile.
Why the C++ approach is different
Most stealth tooling patches from inside the page: redefine navigator.webdriver, override a WebGL getter, shim a property. Every one of those edits is itself observable, because a redefined property does not look like a native one under close inspection.
Camoufox's README states the alternative directly: "In Camoufox, data is intercepted at the C++ implementation level, making the changes undetectable through JavaScript inspection." It is a Firefox fork rather than a wrapper, so the value a script reads is the value the browser genuinely reports.
The rest of its positioning follows from that: "Camoufox is a Firefox fork engineered for web scraping and AI agents. It is headless, undetectable, and optimized to run at scale. Every run gets a fresh identity drawn from the real-world distribution of devices."
Practically, you drive it through Playwright. The Python package describes itself as a "Wrapper around Playwright to help launch Camoufox" and depends on Playwright directly — "Camoufox is compatible with your existing Playwright code. You only have to change your browser initialization."
from camoufox.sync_api import Camoufox with Camoufox() as browser: page = browser.new_page() page.goto("https://example.com")
from camoufox.async_api import AsyncCamoufox async with AsyncCamoufox() as browser: page = await browser.new_page() await page.goto("https://example.com")
The Turnstile solver request, and its answer
Issue #584 is titled *"feat: Cloudflare Turnstile and WAF solver"* and asks for exactly what people arrive looking for. Its opening states the problem cleanly: "Cloudflare Turnstile and WAF 5-second challenges block automated access. Need real browser to solve them and return session cookies."
It was closed as not planned in July 2026. The closing comment folds it into an umbrella proposal and adds: "we will be adding a solver for hCaptcha and reCAPTCHA soon that you can fully self-host if you like, or there will be hosted inference options available as well."
Read what that does and does not say. Two products are named as future work. Turnstile is not among them — which is consistent, because Turnstile is not an image or puzzle challenge that inference solves. It is a browser-environment assessment, and passing it is about being the kind of client Cloudflare accepts rather than about recognising anything.
One user report in the same thread is worth knowing before you plan around clicking the checkbox: "For those that don't get solved automatically and you have to click the checkbox, camoufox (at least the latest forked versions) can't click it." That is a user's claim rather than the project's, but it matches Camoufox's own caveat about interaction: "Camoufox tries its best with its human-like mouse movement algorithm. However, this isn't perfect. It may still be detected with sophisticated enough analysis."
Two warnings the project puts on itself
Both are in the README, and both belong in any decision to deploy it.
"⚠️ This project is under development. It may not be suitable for stable production use. ⚠️"
"Current status as of 2026: There has been a year gap in maintenance due to a personal situation. Camoufox has gone down in performance due to the base Firefox version and newly discovered fingerprint inconsistencies. Camoufox is currently under active development."
The browser builds are still tagged beta, and development has partly moved to other organisations with this repository described as the merge point for checkpoint releases. None of that makes it a bad tool — the C++ approach remains the most interesting one in this space — but a stealth tool that has been paused while the ecosystem moved is in a specific and knowable position.
Watch the version numbers too, because there are two and they are unrelated: the browser build and the Python wrapper are released separately, and the wrapper pins a Playwright range. An upgrade of one without the other is a common source of confusion.
The pattern that works with it
Camoufox is a good browser to be holding when a page needs rendering, and it does not need to be the thing that produces the token. Fetch the token, write it into the field, submit — the browser's job stays being a browser.
import json, os, urllib.request from camoufox.sync_api import Camoufox SITEKEY = "0x4AAAAAAA_target" PAGE = "https://app.example.com/login" req = urllib.request.Request( "https://api.solvegate.io/v1/solve", data=json.dumps({"gate": "turnstile", "sitekey": SITEKEY, "url": PAGE}).encode(), headers={ "Authorization": f"Bearer {os.environ['SOLVEGATE_KEY']}", "Content-Type": "application/json", }, ) with urllib.request.urlopen(req, timeout=30) as res: token = json.load(res)["token"] with Camoufox() as browser: page = browser.new_page() page.goto(PAGE) page.eval_on_selector( '[name="cf-turnstile-response"]', "(el, value) => { el.value = value; " "el.dispatchEvent(new Event('input', { bubbles: true })); }", token, ) page.click("button[type=submit]")
The field name is cf-turnstile-response unless data-response-field-name renamed it — our checker reports the real one. Tokens are single-use and short-lived, so fetch at submit time.
A token typically returns in under 1.5 seconds. Prepaid credits run from $0.40 per 1,000 down to $0.075 at volume; failed solves are never billed; the first 1,000 are free. Solve only against properties you own or are authorised to test.
Common questions
No. It ships no Turnstile solver, and the issue requesting one — titled "feat: Cloudflare Turnstile and WAF solver" — was closed as not planned. The closing comment named hCaptcha and reCAPTCHA as future work and did not mention Turnstile.
It is a Firefox fork rather than a patch applied from inside the page. Its README says fingerprint data is intercepted at the C++ implementation level, which means a script reading a value gets the browser's genuine answer instead of a redefined property that itself looks unusual.
Its own README says it may not be suitable for stable production use, and notes a year-long maintenance gap during which performance declined because of the base Firefox version and newly discovered fingerprint inconsistencies. Development has since resumed. Weigh that against what you are deploying it for.
Users report that it cannot in some builds, and the project is candid that its human-like mouse movement "isn't perfect" and "may still be detected with sophisticated enough analysis". The checkbox also sits inside an iframe within a shadow root, which is a separate reachability problem from detection.
Largely yes — the project says it is compatible and that you only change the browser initialization. The Python package is a wrapper around Playwright and pins a Playwright version range, so keep the browser build and the wrapper in step.
Related
Sources
More in Guides
Automating a gate you own or are authorised to test?
// SolveGate clears Cloudflare Turnstile and WAF challenges through one REST call · first 1,000 solves free