How to bypass DataDome and get the page behind the 403

The DataDome block page is tiny and always the same. Once you have seen it you recognise it in a log by its size alone.

DataDome scores every single request, not only the first one, and it does so on its own servers before the site answers. Four things decide the score.

• The IP and its history: hosting ranges, and addresses that sent too much traffic, start with a bad score.
• The client: the TLS handshake, the HTTP/2 settings and the headers must describe one real browser. DataDome compares them with the User-Agent.
• The device check: a script collects signals from the browser and posts them back. A client that cannot run it stays on the 403.
• The cookie: datadome belongs to the client that earned it. Sent from a different client, even on the same IP, it is refused and the check starts again. This is why a cookie copied from your own browser into a script works for a few minutes at best.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When DataDome answers with its device check, a real browser opens the page, lets the check finish and returns the page behind it.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

For many pages of one site, keep calling from the same account. The first call waits for the device check; the next ones reuse the session, which the answer reports in clearance.

What the answer tells you

In the canary of 11 November 2026, 11 of 12 calls to DataDome-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

The first request to a protected site waits for the site's own check. The next ones from the same account reuse the session: in our test of 11 November 2026, four requests in a row to the same DataDome-protected page took 12.6 s, 2.5 s, 2.9 s and 2.3 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past DataDome once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.