Metadata-Version: 2.4
Name: arkose-solver
Version: 1.2.0
Summary: Pure-Python Arkose Labs / FunCaptcha solver producing sup=1 suppressed tokens, with the site RSA key derived per solve
Author: buggerlogger
License-Expression: MIT
Project-URL: Homepage, https://github.com/buggerlogger/arkose-solver
Project-URL: Repository, https://github.com/buggerlogger/arkose-solver
Project-URL: Issues, https://github.com/buggerlogger/arkose-solver/issues
Keywords: arkose,arkoselabs,funcaptcha,captcha,captcha-solver,bda,token,anti-bot,reverse-engineering
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Testing
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=41
Requires-Dist: curl_cffi>=0.7
Dynamic: license-file

# arkose-solver (Python)

Pure-Python Arkose Labs / FunCaptcha solver producing `sup=1` suppressed tokens.
The site's RSA public key is derived from the served `api.js` on every solve, so
there is nothing to capture or pin.

```bash
pip install arkose-solver
```

```python
from arkose_solver import Solver

s = Solver(
    surl="https://verify.example.com",
    public_key="00000000-0000-0000-0000-000000000000",
    site="https://www.example.com",
    proxy="http://user:pass@host:port",   # optional
)
res = s.solve()
print(res.token, res.suppressed)
```

`solve()` returns `SolveResult(token, suppressed, timings)`. `suppressed` is
`True` when the token carries `sup=1`.

## Options

`Solver(surl, public_key, site=None, rsa_public_key=None, proxy=None,
user_agent=None, language="en-US", capi_mode="lightbox", title="",
referer=None, origin=None, sitedata_location_href=None,
document_referrer=None, data_exchange_url=None, data_exchange_regex=None)`

`rsa_public_key` is only an override; leave it unset and it is extracted from
`api.js` automatically.

## Conformance

```bash
python tests/conformance.py
```

Checks every derivation against `../testvectors.json` (generated by the Go
implementation, which asserts each value against captured ground truth) and
then verifies 20 freshly generated payloads are internally self-consistent —
`f`, `ife_hash`, `webgl_hash_webgl`, `network_info_rtt_type` and
`screen_pixel_depth` all recomputed from the payload itself.

## Transport

Uses `curl_cffi` with Chrome impersonation. Arkose reads the TLS fingerprint
(JA3/JA4), so `requests`/`httpx` will not do regardless of how correct the
payload is.
