How to bypass Kasada and its empty 429 page

Kasada shows no message and no captcha. The block is a status code that seems to mean something else, and a page with nothing on it.

Kasada does not ask a visitor to prove anything by hand. It makes every new visitor prove it is a real browser before the site answers at all.

• The first answer is always the script. It runs inside the browser, checks that the environment is a genuine one and does a small piece of computing work.
• The result goes back as a token. Only then does the page reload with the real content.
• Every API call after that has to carry fresh x-kpsdk headers produced by the same script.
• The script changes often, so an answer written by hand stops working without notice.
• For a scraper this means the first request to a Kasada site needs a real browser. There is no cheaper path.

Send the URL to the REST endpoint. On a Kasada site the engine opens a real browser on a residential IP, lets the script run, waits for the page to reload and returns the page that arrived after the reload, with the status of that page.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

Leave mode on auto. With mode: "tls" no browser is opened, and on a Kasada site the first call then comes back blocked. For many pages of one site, keep calling from the same account so that the session is reused.

What the answer tells you

In the canary of 11 November 2026, all 6 calls to Kasada-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

The first request to a protected site waits for the site's own check. The next ones from the same account reuse the session: in our test of 11 November 2026, four requests in a row to the same Kasada-protected page took 11.9 s, 1.9 s, 1.9 s and 1.8 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past Kasada once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.