Captcha solving that fits inside the request you already make
Legibl is a solving gateway with SDKs for PHP and Python. The SDK detects a challenge in a response you were already fetching, asks the gateway for a solution, resubmits the blocked request once, and tells you what happened. Four captcha types, named exactly, below.
What it actually does
The SDK never solves
No browser engine and no inference runtime ship in either SDK, in any language — that is asserted against the lock file, not just the declared dependencies. Nothing heavyweight lands in your production tree.
It replaces the eighty lines
Detect, extract the sitekey, submit a task, poll, inject the token,
resubmit. Every vendor makes you write that. In PHP it is a per-file
use function
swap over curl_*; in Python it is
an httpx
transport.
It routes between vendors
The gateway sits in front of several solving vendors, measures them, and fails over. Vendors differ in latency by an order of magnitude and none of them publish the tail — we measure it per target rather than take a published figure on trust.
The four supported types
Four, and the list is short on purpose: a type that is claimed but not implemented costs a customer a production incident to discover.
| Type | Identifier | Per 1,000 | Notes |
|---|---|---|---|
| reCAPTCHA v2 | recaptcha_v2 |
$0.80 | Checkbox and challenge widgets. Detected and resubmitted by both SDKs. |
| reCAPTCHA v2 invisible | recaptcha_v2_invisible |
$0.80 | Priced the same as the visible variant. Invisible volume is reported separately because a rise in it is a signal about your client reputation, not about the solver. |
| Cloudflare Turnstile | turnstile |
$1.20 | Managed, non-interactive and invisible widgets are configured against the sitekey and are indistinguishable from the page, so they are one price. |
| Image OCR | image_ocr |
$0.60 | Accepted by the API. Not yet handled by the SDKs' automatic path — you submit the image yourself. |
hCaptcha, DataDome, Kasada, PerimeterX / HUMAN, FunCaptcha / Arkose. There is no
detection and no task type for any of them. A page carrying one yields a
no_challenge
outcome, which means the SDK found no challenge it
knows about — not that the page was served normally.
Five lines, either language
PHP
use function Legibl\{curl_init, curl_setopt, curl_exec, curl_close};
$ch = curl_init('https://example.test/protected');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$body = curl_exec($ch); // a challenge here is solved and the request resubmitted
curl_close($ch);
The import is per file. That is the honest cost of the drop-in: files you do
not touch keep calling PHP's own curl_* and are unaffected.
Python
import httpx
from legibl.transport.httpx_transport import LegiblTransport
with httpx.Client(transport=LegiblTransport()) as client:
body = client.get("https://example.test/protected").text
Both read the key from LEGIBL_API_KEY. The documentation
covers configuration, the typed errors and
what each one means you should do.
What we claim, and what we do not
Two claims are evidenced and we lead with them: integration, because no vendor in this market competes on it, and reliability, because vendor latency and failure rates diverge sharply and nobody publishes the tail. In our own benchmark one incumbent failed 20% of reCAPTCHA v2 solves at a 180-second ceiling while charging more than twice the cheapest vendor that failed none.
We measure cost per accepted solve, per target domain, and show it to you. We are not claiming it beats list-price shopping, because we have not demonstrated that: across 195 verified solves against a property we control, every token was accepted, so the two numbers were identical. That is a fact about an undefended target. Divergence is what a hostile target produces, and until we have measured one, the instrument is real and the conclusion is not.
What you may point it at
Systems you own, or systems whose operator has authorised you to access them. That is the line, it is the whole line, and it is set out with the specifics in the acceptable use policy. If you believe Legibl is being used against something you run, report it — no account required.