> ## Documentation Index
> Fetch the complete documentation index at: https://docs.roolink.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Solve an SBSD challenge

> When an Akamai site answers 429 with a token, it is an SBSD challenge, not a rate limit. Solve it and retry.

On SBSD sites a `429 Too Many Requests` is usually not about rate. It is Akamai challenging the request and asking for an SBSD payload before it will answer. Solve the challenge once, then retry the request that was refused.

This page assumes you know the passive flow on the [SBSD](/akamai-web/sbsd) page. The steps are the same; the differences are the token, a single payload instead of two, and the success check.

## How to recognize it

Either of these means you are being challenged:

* A request returns `429` with a small JSON body containing a token: `{"t": "259288945"}`.
* A page response contains the SBSD script tag with a `t` parameter in its query string, in addition to the usual `v`:

```html theme={null}
<script src="/.well-known/sbsd?v=f96b0144-83cf-fd90-7200-553b2f046010&t=259288945"></script>
```

The `t` value is the **challenge token**. You need it, the visitor id and the SBSD cookie, exactly as in the passive flow.

## The flow

<Steps>
  <Step title="Read the token, the visitor id and the cookie">
    When the 429 body is a page, its SBSD script tag carries the path, `v` and `t` together; read all three from it. When the body is the small JSON object, take `t` from it and reuse the path and `v` from the SBSD script you saw on the page before. Take `sbsd_o`, `bm_so` or `bm_o` from the jar.
  </Step>

  <Step title="Generate one payload">
    Call `/sbsd` as in the passive flow with `index: 0`. A challenge takes a single payload, not the pair a page load takes.
  </Step>

  <Step title="Post it with the token">
    Post to the script path with `?t=<token>` appended, as JSON with the payload under `body`, through the same session.

    ```http theme={null}
    POST /.well-known/sbsd?t=259288945 HTTP/2
    content-type: application/json
    referer: https://www.example.com/product/123

    {"body": "<payload from Roolink>"}
    ```
  </Step>

  <Step title="Check the cookie">
    The response sets a cookie named `bm_sc`, `sbsd_sc` or `sbsd_c`. Its value **starts with `2`** when the challenge is passed. Any other first character means the payload was refused.
  </Step>

  <Step title="Retry the original request">
    Send the request that got the 429 again, unchanged, through the same session. It should now return the real content.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The cookie never starts with 2">
    The payload was refused. The usual cause is a mismatch between the User-Agent, the language and the session that fetched the page. Confirm you post through the same session, and that the cookie value is the current one from the jar, not a saved copy.
  </Accordion>

  <Accordion title="The site returns another 429 straight after a successful solve">
    Do not loop. One solve per challenge; if the same session is challenged again immediately, the IP or the session is flagged. Start a fresh session on a fresh sticky proxy.
  </Accordion>

  <Accordion title="There is no `t` in the 429 body">
    Then it is a real rate limit or a block from another layer. Slow down and check the sensor flow before treating it as SBSD.
  </Accordion>
</AccordionGroup>