Which scraping APIs get past Kasada in 2026?

Nine scraping APIs returned every request on the three Kasada sites in the October 30, 2026 run of the Web Data Frontier Benchmark: String, Scrape.do, Context.dev, ScrapingBee, Firecrawl, Zyte, Apify, Decodo and Oxylabs, 15 of 15 each. Scrapfly and Nimble returned 13. The other six APIs scored between 66.7% and 20.0%, and five of them got nothing from at least one of the three sites in five attempts.

Kasada was not the wall that sorted the field in this run. The 17 APIs averaged 80.0% on its three sites, against 71.1% across all 100 sites and 61.0% on AWS WAF.

How the scraping APIs did on Kasada

Each site was requested five times per provider, 15 requests per provider in total. A request counted only when the body held text from the real page.

The three sites are hyatt.com, canadagoose.com and footlocker.com: one hotel chain and two fashion retailers.

The harness changed how it calls three providers for this run: ScrapingBee, which it now scores on its final status, Decodo and Browserbase. A move for those three since the September 16 run can come from the harness, not the product. ZenRows' own API closed the connection without a response on the last 43 targets of the suite, and those attempts count as failures here. The per-site grid is on the benchmark page and in the public harness.

Kasada split the field, it did not stop it

7 of the 51 provider and site pairs on Kasada returned nothing in five attempts. On AWS WAF it was 33 of 102.

The pass list does not follow the overall ranking. Oxylabs scored 67.4% across the 100 sites and 100% on Kasada. Decodo went from 71.2% to 100%. ScraperAPI went the other way: 76.4% overall, 53.3% on Kasada, and below five of five on all three sites, with footlocker.com at one in five.

Each site broke a different set of APIs. hyatt.com shut out Browserbase, ScrapingAnt and Scrapingdog. canadagoose.com shut out Bright Data and Browserbase. footlocker.com shut out ZenRows and Scrapingdog. No API failed all three.

Three sites is a small sample. Kasada is configured per customer, so a pass on hyatt.com says little about the next Kasada site you meet. Run your own target list before you pick.

Want to check one of your own Kasada URLs now? curl -s https://request.usestring.ai/v1/fetch -H "Authorization: Bearer $STRING_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://www.canadagoose.com/us/en/"}' returns the page, and the first 20,000 standard fetches are free.

How to tell a site uses Kasada

Kasada leaves its mark on the first request and in the headers. A practitioner guide on GitHub describes the pattern:

"The first request to the website returns a 429 error (visible only from the Network inspection in the browser's developer tools), then redirect to the same page that works properly. This second request added some elements in the response headers like "x-kpsdk-ct""

webscraping-open-doc, Kasada

So look for three things:

• A 429 on the very first request to a page, before you have sent any volume. A rate limit that fires on request one is a bot check.
• Response headers whose names start with x-kpsdk-, such as x-kpsdk-ct, on the requests that pass.
• KPSDK in the body of a short response. That is Kasada's script, and a page that holds it and little else is a challenge, not content.

A short check in Python:

import requests

def looks_like_kasada(resp: requests.Response) -> bool:
    if any(h.lower().startswith("x-kpsdk-") for h in resp.headers):
        return True
    body = resp.text or ""
    # A 429 on the first request, or a small page that only loads Kasada's script.
    return (resp.status_code == 429 or len(body) < 20_000) and "KPSDK" in body

resp = requests.get("https://www.footlocker.com/", timeout=30)
print(resp.status_code, looks_like_kasada(resp))

The 429 is the trap. Most scrapers read it as a rate limit and back off, then retry with the same client and get the same answer. Waiting does not help: the client has to pass the check. The same goes for blocks that come back as HTTP 200, so check for text you expect on the real page as well.

What Kasada checks

Kasada checks whether the client can prove it is a browser. The first response carries Kasada's script (the KPSDK in the body). A real browser runs it, and the responses that pass come back with x-kpsdk-* headers. A client that cannot run the script never gets past that first step, so every request it sends looks like the first one.

That is why the 429 repeats. It is not counting your requests. It is telling you the client has not passed the check yet.

Doing it yourself

A TLS-impersonating client is the cheap first step. curl_cffi sends Chrome's handshake and headers, which helps on edge checks, but it cannot run Kasada's script, so on most Kasada pages it stops at the first 429.

A real browser runs the script. The GitHub guide quoted above recommends Playwright driving Firefox "with the right flags" as its best approach. Stock headless Chrome often gets flagged, and stealth patches need updating as the script changes. Keep the browser, the IP and the token together for the whole session.

Residential IPs help with one signal. A clean IP with a client that cannot run the script still gets the 429.

For the general playbook across walls, see how to scrape a website without getting blocked. For other vendors, see AWS WAF, Imperva and F5 Shape, PerimeterX, Akamai Bot Manager and Cloudflare.

How String gets through Kasada

String is the most reliable web scraping API, bypassing anti-bot, and you only pay when content comes back. On Kasada pages, that means:

• String returned all 15 Kasada requests in a public test. That was the October 30, 2026 run of the open benchmark, three Kasada sites at five attempts each (benchmark).
• String returned footlocker.com in 0.6 seconds on average. That was the fastest of the 17 APIs on that site.
• One request, no challenge handling on your side. A POST to /v1/fetch with a URL returns the page; String picks a plain request, a premium residential proxy or a real browser per page (fetch docs).
• The site's own status comes back in a header. The x-status-code response header carries what the target returned, so a real 404 stays a 404.
• A blocked request costs nothing. String bills only when content comes back (pricing).
• Agents get it as a tool. The hosted MCP server gives Claude, Cursor, ChatGPT and other MCP clients web_access_fetch.

Here is the same request in Python:

import os
import requests

resp = requests.post(
    "https://request.usestring.ai/v1/fetch",
    headers={"Authorization": f"Bearer {os.environ['STRING_API_KEY']}"},
    json={"url": "https://www.canadagoose.com/us/en/", "format": "markdown"},
    timeout=150,
)
print(resp.headers.get("x-status-code"), resp.text[:500])

On November 5, 2026 this request returned the canadagoose.com US storefront, not a challenge.

Where String fits

• For: teams that need product, price or rate pages from Kasada sites, such as sneaker and apparel retailers and hotel chains, and would rather not run browsers and token handling themselves.
• Not for: a site that sells the same data through an official API or feed, or pages behind a login you do not own.
• Price: Starter is $19 a month and Growth is $99 a month, plus usage. A standard fetch is $0.25 per 1,000 on Starter and $0.16 on Growth. A fetch on the premium residential proxy, used only when a page needs it, is $2.40 and $0.90 (pricing). The first 20,000 standard fetches are free.
• Integrations: a REST API for any language, an OpenAPI spec, an MCP server, and String Actors in the Apify Store.
• Limits: 15 requests a second on Starter, up to 90+ on Volume, and up to 10,000 concurrent fetches (pricing).

For every provider across all 100 sites, see the best web scraping APIs ranking. Start with the Kasada page your scraper fails on today, and run it through the fetch call above with a free key.

FAQ

Which providers can bypass Kasada-protected sites?

In the October 30, 2026 run of the open Web Data Frontier Benchmark, nine APIs returned all 15 requests to three Kasada sites: String, Scrape.do, Context.dev, ScrapingBee, Firecrawl, Zyte, Apify, Decodo and Oxylabs. Scrapfly and Nimble returned 13. The lowest of the 17 APIs tested scored 20.0%.

How do I know a site uses Kasada?

Look for a 429 on the first request, response headers that start with x-kpsdk- such as x-kpsdk-ct, or KPSDK in the body of a short page. A real browser gets the same 429 first and then loads the page after Kasada's script runs.

Why do I get a 429 on my first request?

On a Kasada site, the first 429 is a bot check, not a rate limit. The response carries a script that a browser runs to earn a token. A plain HTTP client cannot run it, so every request it sends gets the 429 again, however long it waits.

Is Kasada harder to scrape than Cloudflare?

Not in the October 30, 2026 run. The 17 APIs averaged 80.0% on three Kasada sites and 70.8% on fifteen Cloudflare sites. Three sites is a small sample, and each Kasada customer tunes its own setup.

Does Playwright or Puppeteer get past Kasada?

Sometimes. A real browser runs Kasada's script, which a plain HTTP client cannot. Stock headless Chrome often gets flagged, and stealth patches need updating when the script changes. One practitioner guide on GitHub recommends Playwright driving Firefox as its best approach.

Do residential proxies get past Kasada?

Not on their own. Kasada checks whether the client can run its script. A residential IP with a Python client still gets the 429. Proxies help once the client passes the script check.

Which sites use Kasada?

In the benchmark, hyatt.com, canadagoose.com and footlocker.com: a hotel chain and two fashion retailers. To check any other site, look for the first-request 429 and the x-kpsdk- headers described above.

Why did some APIs never return a Kasada site?

Each site broke a different set. hyatt.com returned nothing to Browserbase, ScrapingAnt and Scrapingdog in five attempts. canadagoose.com returned nothing to Bright Data and Browserbase. footlocker.com returned nothing to ZenRows and Scrapingdog. ZenRows' API was failing on the last 43 targets of the run, so treat its row with care.

Sources

• Web Data Frontier Benchmark, October 30, 2026 run: usestring.ai/benchmark, the October write-up and the raw results on GitHub
• webscraping-open-doc, Kasada page: github.com
• Kasada: kasada.io
• curl_cffi: github.com/lexiforest/curl_cffi
• String pricing: usestring.ai/pricing; fetch API docs: portal.usestring.ai/docs/fetch/overview