Sec-CPT

Sec-CPT is a proof-of-work challenge. Instead of studying the browser, Akamai hands it a puzzle that takes real computation to solve, then checks the answers. Roolink does the computing; you do the waiting and the posting.

How to recognize it

A request returns 428 Precondition Required with a JSON body:

{
  "sec-cp-challenge": "true",
  "provider": "crypto",
  "branding_url_content": "/_sec/cp_challenge/crypto_message-3-6.htm",
  "chlg_duration": 30,
  "token": "AAQAAAAJ…",
  "timestamp": 1758000000,
  "nonce": "b0a3…",
  "difficulty": 5000,
  "timeout": 1000,
  "cpu": true
}

A cookie named sec_cpt arrives with it. Its value contains ~1~ while the challenge is open. Some sites serve the challenge inside an HTML page instead, as an element with provider="adaptive" and a challenge="…" attribute holding the same JSON, base64-encoded. Decode it and continue the same way. The provider field tells you which kind you have:

Provider	What it is	Roolink
`crypto`	Pure proof of work. One round.	Solves it with `/sec-cpt`.
`adaptive`	Proof of work plus a sensor on the challenge page. Akamai may escalate with further rounds.	Solves the proof of work with `/sec-cpt`; you post a sensor for the challenge page as well.
`behavioral`	A separate flow built on a `verify_url`.	Not handled.

The flow

Keep everything from the 428

Save the JSON body and the sec_cpt cookie. Every field goes to Roolink, and the cookie is part of the puzzle.

Ask Roolink for the answers

Call /sec-cpt with the challenge fields and the sec_cpt cookie value. Roolink returns the token and an array of answers.

from roolink import SecCptRequest

solved = roolink.solve_sec_cpt(SecCptRequest(
    token=ch["token"],
    timestamp=ch["timestamp"],
    nonce=ch["nonce"],
    difficulty=ch["difficulty"],
    count=ch.get("count", 10),
    cookie=site.cookies.get("sec_cpt"),
    provider=ch.get("provider"),
    timeout=ch.get("timeout"),
    chlg_duration=ch.get("chlg_duration"),
))

solved, err := rl.SolveSecCpt(context.Background(), roolink.SecCptRequest{
    Token:        ch.Token,
    Timestamp:    ch.Timestamp,
    Nonce:        ch.Nonce,
    Difficulty:   ch.Difficulty,
    Count:        ch.Count,
    Cookie:       cookie(jar, page, "sec_cpt"),
    Provider:     ch.Provider,
    Timeout:      ch.Timeout,
    ChlgDuration: ch.ChlgDuration,
})

const solved = await roolink.solveSecCpt({
  token: ch.token,
  timestamp: ch.timestamp,
  nonce: ch.nonce,
  difficulty: ch.difficulty,
  count: ch.count ?? 10,
  cookie: await cookie("sec_cpt"),
  provider: ch.provider,
  timeout: ch.timeout,
  chlg_duration: ch.chlg_duration,
});

Wait

The challenge carries a wait, chlg_duration, in seconds. Submitting before it has passed does not get you through any sooner: Akamai holds the verdict until the duration is up, so wait the full duration after receiving the challenge, then submit. Roolink does not wait for you. Adaptive escalation rounds carry a timeout in milliseconds instead; wait that long.

Submit the answers

Post the token and answers as JSON to the site’s verify endpoint, with the provider from the challenge:

POST /_sec/verify?provider=crypto HTTP/2
content-type: application/json

{"token": "AAQAAAAJ…", "answers": ["…", "…"]}

For crypto, one round is all there is: a success response means the puzzle is cleared and you continue to the next step. For adaptive, three things can come back:

{"success": false}: the answers were rejected. Stop and check the wait and the cookie.
A new challenge with a fresh token, timestamp, nonce and difficulty: Akamai is escalating. Repeat from step 2 with the new values. Five rounds is the practical ceiling.
A body with no token: the puzzle is cleared. Continue.

Finish the clearance

Request GET /_sec/cp_challenge/verify through the same session, with whatever query string the browser used in your powhttp recording. This is the step that actually upgrades _abck. Afterwards the sec_cpt cookie contains ~3~; ~1~ and ~2~ mean the challenge is still open.

Tell the sensor about it

For the rest of the session, set sec_cpt: true on your /sensor calls. crypto needs nothing else. For adaptive, also post a sensor for the challenge page itself before the first submission and between rounds: use the challenge page’s URL as url, keep stepper on, and turn keyboard on.

Request fields

Field	Required	What it does
`token`	yes	From the challenge.
`timestamp`	yes	From the challenge.
`nonce`	yes	From the challenge.
`difficulty`	yes	From the challenge.
`cookie`	yes	The `sec_cpt` cookie value. Must contain `~`.
`count`	no	How many answers Akamai expects, when the challenge says.
`provider`	no	`crypto` or `adaptive`. Informational.
`timeout`, `chlg_duration`, `cpu`, `branding_url_content`, `sec-cp-challenge`	no	Pass them through from the challenge.

Troubleshooting

The Roolink call times out

Very high difficulty takes longer to solve. Retry once. If it repeats, the challenge is escalating against a flagged session; start a fresh session.

Every submission answers success false

Either you submitted before the wait elapsed, or the sec_cpt cookie you sent to Roolink is not the one the site holds. Read it from the jar immediately before each /sec-cpt call.

The difficulty never drops and the rounds keep coming

Make sure you replace all four of token, timestamp, nonce and difficulty from each new challenge. Reusing any of them restarts the escalation.

Cleared, but _abck is still ~-1~

The final GET /_sec/cp_challenge/verify was skipped. It is required.

Get started

Products

How to recognize it

The flow

Request fields

Troubleshooting

​How to recognize it

​The flow

​Request fields

​Troubleshooting

How to recognize it

The flow

Request fields

Troubleshooting