How to Solve AWS WAF Captcha & Challenge in Python: Playwright & 2Captcha Guide

1. How AWS WAF Captcha Works

Amazon Web Services Web Application Firewall (AWS WAF) employs a multi-tiered bot defense engine. When suspicious automation behavior, abnormal IP reputation, or high request velocity is detected, the WAF responds with an HTTP 405 Method Not Allowed or an interstitial HTML challenge containing an encrypted payload (context and iv vector).

Once the interactive puzzle (grid alignment or sound challenge) is completed, the client receives a signed JWT token stored in the aws-waf-token session cookie. All subsequent requests passing this valid cookie bypass the WAF without further friction.

2. Installing Required Dependencies

To automate AWS WAF resolution in Python, install the official 2captcha-python client library and playwright:

pip install 2captcha-python playwright
playwright install chromium

3. Basic Task Dispatch via 2Captcha SDK

The TwoCaptcha SDK handles dispatching the cryptographic challenge parameters and polling until the solver network completes verification:

import os
from twocaptcha import TwoCaptcha

api_key = os.getenv("TWOCAPTCHA_API_KEY")
solver = TwoCaptcha(api_key)

try:
    print("Dispatching AWS WAF Captcha task to 2Captcha...")
    # 2Captcha Amazon / AWS WAF task handler
    result = solver.amazon_waf(
        sitekey="AQIDAHjc7zVn...", # Or captured challenge parameters
        url="https://target-portal.com/protected-page",
        context="AQIDAH...",       # Context payload from AWS WAF script
        iv="F3r7..."               # IV vector from AWS challenge
    )
    token = result["code"]
    print("AWS WAF Captcha solved successfully!")
    print(f"Token: {token[:45]}...")
except Exception as e:
    print(f"AWS WAF solving error: {e}")

4. End-to-End Playwright Automation with Cookie Injection

In production web scraping pipelines, AWS WAF challenges intercept navigation dynamically. The following script detects the interstitial page, collects parameters, requests the token from 2Captcha, and injects the aws-waf-token directly into the browser context:

import asyncio
import os
from playwright.async_api import async_playwright
from twocaptcha import TwoCaptcha

API_KEY = os.getenv("TWOCAPTCHA_API_KEY")
solver = TwoCaptcha(API_KEY)
TARGET_URL = "https://example-aws-protected.com/data"

async def main():
    async with async_playwright() as p:
        # Launch browser with stealth settings
        browser = await p.chromium.launch(headless=True)
        context = await browser.new_context(
            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
        )
        page = await context.new_page()

        print("Navigating to AWS WAF protected target...")
        response = await page.goto(TARGET_URL)

        # Check if AWS WAF Captcha / Challenge intercept triggered (HTTP 405 or captcha container)
        if response.status == 405 or await page.query_selector("#waf-captcha"):
            print("AWS WAF Captcha triggered! Extracting challenge parameters...")

            # Extract challenge inputs from window.AwsWafCaptcha or DOM
            waf_meta = await page.evaluate("""() => {
                return {
                    url: window.location.href,
                    key: window.AwsWafCaptcha?.key || "",
                    context: window.AwsWafCaptcha?.context || "",
                    iv: window.AwsWafCaptcha?.iv || ""
                };
            }""")

            print(f"Requesting solution from 2Captcha for {waf_meta['url']}...")
            result = solver.amazon_waf(
                url=waf_meta["url"],
                sitekey=waf_meta["key"] or "sample-sitekey",
                context=waf_meta["context"],
                iv=waf_meta["iv"]
            )
            token = result["code"]
            print("Token received! Injecting aws-waf-token cookie into Playwright session...")

            # Set AWS WAF authorization cookie
            await context.add_cookies([{
                "name": "aws-waf-token",
                "value": token,
                "domain": "example-aws-protected.com",
                "path": "/"
            }])

            # Reload protected page with validated token
            print("Reloading page with verified AWS token...")
            response = await page.goto(TARGET_URL, wait_until="networkidle")
            print(f"Bypass successful! Status: {response.status}")

        title = await page.title()
        print(f"Protected page title: {title}")
        await browser.close()

if __name__ == "__main__":
    asyncio.run(main())

5. Why 2Captcha is Rated #1 for AWS WAF Resolution

2Captcha AWS WAF Telemetry

Rank #1 Overall

Average Solving Speed: 8.2 seconds (hybrid AI-accelerated solver network)
Accuracy & Pass Rate: 99.4% first-attempt token acceptance on AWS WAF
Pricing: $1.50 per 1,000 solves with no mandatory monthly subscription
Proxy Integration: Supports custom residential proxy binding for geo-restricted endpoints

Get 2Captcha API Key ($1.50/1k) →