An API for anti-bot payloads

tamago is an HTTP API for developers whose software makes its own web requests. When a website protects itself with Akamai Bot Manager or Imperva Incapsula, it asks the visitor for a payload that a browser would normally compute. tamago computes that payload, so automation that does not run a browser can send it.

What you get

Akamai Bot Manager: the sensor payload behind the _abck cookie, and the SBSD payload.
Imperva Incapsula: the payload the site exchanges for the reese84 token, and the ___utmvc cookie.

How it works

Your software fetches the page and the challenge script from the website.
It sends the script to tamago. tamago returns the payload.
Your software sends the payload to the website with its own request.

To answer your call, tamago makes no request to the website. Your software makes its own requests to the website, from your own network.

Who it is for

Developers running their own request-based automation. Every account is reviewed by a person before it is opened: we ask what you are building and which websites it runs against.

We refuse anything that needs somebody else’s account or money: account takeover, credential stuffing, card testing and fraudulent checkouts. The terms list the rest.

What it costs

You pay from a prepaid balance, only for calls that succeed. The pricing page has the figures.

Getting access

Write to support@tamagoapi.com. Tell us what you are building, which vendor you need (Akamai or Incapsula), and where it runs. A person reads every request, and admission is by hand, in small batches.

Akamai and Imperva are trademarks of their owners. tamago is not affiliated with or endorsed by either.