POST /solve

AWS WAF

Generates an AWS WAF challenge token from the mobile SDK. Attach the token to subsequent requests as a header or cookie.

Authentication

Pass your API key via the X-API-Key header on every request.

Keep your key secret. Never expose it in client-side code or commit it to version control.

Mobile SDK only. This solver is designed for AWS WAF challenges in iOS/Android mobile apps — not web browsers. You need the sdk_url extracted from the mobile app binary.

Endpoint

POST/solve

Parameters

ParameterTypeRequiredDescription

task_typestringyesMust be "awswaftask"

urlstringyesTarget application domain URL

sdk_urlstringyesAWS WAF SDK endpoint extracted from the mobile app (see below)

proxystringyesProxy in http://user:pass@ip:port format

user_agentstringnoMobile app user-agent

osstringno"ios" or "android" — auto-detected from user_agent if omitted

Finding the SDK URL

The sdk_url is hardcoded in the mobile app and matches this pattern:

https://xxxxx.edge.sdk.awswaf.com/xxxxx/xxxxx/challenge.js

HTTP proxyIntercept app traffic with Charles Proxy or mitmproxy and look for requests matching the pattern above.

DecompilationDecompile the APK/IPA and search for the awswaf.com URL string.

Pattern matchSearch for "edge.sdk.awswaf.com" in the app binary or network logs.

Request / Response

Request

{
  "task_type": "awswaftask",
  "url": "https://app.example.com/",
  "sdk_url": "https://xxxxx.edge.sdk.awswaf.com/xxxxx/xxxxx",
  "proxy": "http://user:pass@1.2.3.4:8080",
  "os": "android"
}

Response

{
  "success": true,
  "data": {
    "token": "eyJxxxxxxxxxxxxxx..."
  }
}

Attach the token as the x-aws-waf-token header, or as the aws-waf-token cookie — whichever the target app expects.

Code Examples

import requests

# Get token from Peak API
response = requests.post(
    "https://api.peak.fo/solve",
    headers={
        "X-API-Key": "pk_your_api_key",
        "Content-Type": "application/json"
    },
    json={
        "task_type": "awswaftask",
        "url": "https://app.example.com/",
        "sdk_url": "https://xxxxx.edge.sdk.awswaf.com/xxxxx/xxxxx",
        "proxy": "http://user:pass@1.2.3.4:8080",
        "user_agent": "AppName/1.0 (iOS 17.0)"
    }
)

data = response.json()
if data["success"]:
    token = data["data"]["token"]
    print(f"Token: {token}")

    # Use token in your requests:
    # Header: x-aws-waf-token: {token}
    # Cookie: aws-waf-token={token}
else:
    print(f"Error: {data['error']}")