How to get past Akamai Bot Manager when scraping public data
Published: 30 August 2026 · 8 min read
TL;DR: Akamai Bot Manager rarely shows a challenge - it scores you silently on three things: IP/ASN reputation, your TLS/HTTP2 fingerprint, and the sensor data a real browser computes and posts into the _abck cookie. An HTTP script fails all three at once. The reliable setup is a residential proxy for the IP plus a real browser (Playwright) through that same proxy so the sensor data is genuine. curl_cffi alone fixes the fingerprint but cannot produce valid sensor data. Scrape public data only, and rate-limit.
Akamai does not challenge you - it scores you
Unlike a visible CAPTCHA, Akamai Bot Manager usually blocks in silence. There is no "prove you're human" page - just a 403, an Access Denied, or a reference-number error page that looks like a server fault. The useful question is not "how do I bypass Akamai" but "which of its signals am I failing?", because Akamai builds a single score from several independent inputs and each one has a different fix.
| Layer | What Akamai checks | How you fail it | The fix |
|---|---|---|---|
| IP reputation | The exit IP's ASN and history | Requesting from a datacenter range | Residential proxy |
| TLS / HTTP2 fingerprint | Your ClientHello (JA3/JA4) | A Python/library fingerprint | curl_cffi or a real browser |
Sensor data (_abck) | Behavioral + device signals from JS | No JS engine to run the sensor | A real browser through the proxy |
Layer 1: IP reputation - checked first, faked never
Before Akamai reads anything your client sends, it scores the IP. Datacenter ASNs (AWS, Hetzner, OVH) carry a standing penalty because real shoppers and readers almost never come from them. No header, no fingerprint trick, and no browser can change the ASN you exit from - only routing through a different network can.
A residential proxy gives Akamai a real home-broadband IP to score. This is the layer you cannot solve in code, and on Akamai sites it is the precondition for everything else - a perfect browser fingerprint from a flagged datacenter IP still loses.
Layer 2: TLS fingerprint - the silent handshake block
During the TLS handshake, Akamai hashes your ClientHello into a JA3/JA4 fingerprint. Python's requests and httpx emit a fingerprint no real browser produces, so Akamai can score you before the page even starts loading. If you are scripting with HTTP requests, restore a browser-accurate fingerprint with curl_cffi. Combined with a residential proxy, that clears layers 1 and 2 in one script:
from curl_cffi import requests
proxies = {"https": "http://USER:PASS@gw.roamproxy.com:41080"}
r = requests.get("https://target.example", impersonate="chrome124", proxies=proxies)
print(r.status_code)For the full picture of how these fingerprints work and why libraries get flagged, see JA3 and JA4 TLS fingerprinting explained.
Layer 3: sensor data - the layer that needs a real browser
This is what makes Akamai harder than a plain IP or TLS check. Akamai serves client-side JavaScript that collects sensor data - timing, event patterns, and device/browser signals - and posts it back, after which Akamai sets the _abck cookie to a "passed" state. An HTTP library has no JavaScript engine, so it never produces valid sensor data, and Akamai keeps every request scored as a bot no matter how clean the IP and fingerprint are.
The reliable answer is a real browser that runs the sensor script - headless Chromium via Playwright, or an LLM-driven agent on top of it. Point that browser through the same residential proxy so the IP the sensor sees matches the IP the request comes from. See using residential proxies with browser-use for the browser-plus-proxy setup; the same proxy dict works for plain Playwright.
Match the tool to the layer
- Blocked by IP only (works locally, fails from a server) - a residential proxy is often the whole fix.
- Silent 403 with a clean IP and correct headers - a TLS fingerprint block; add curl_cffi.
Access Denied/ reference-error page that persists with a good IP and fingerprint - Akamai wants valid sensor data; use a real browser through the proxy.
Do not reach for a full headless browser when a residential IP plus curl_cffi would do - the browser is slower and heavier. Escalate only as far as the target's actual defense requires. For the broader checklist of why scrapers get blocked, see how to avoid getting blocked while web scraping.
Collect public data responsibly. These techniques are for scraping publicly accessible pages at a reasonable rate. Honor robots.txt and a site's terms where they apply, do not access data behind an authorization you do not have, and rate-limit so you are never degrading the site for its real users.
FAQ
What is the _abck cookie and why does it block me?
_abck is the cookie Akamai's client-side JavaScript writes after it collects sensor data - mouse movement, timing, device and browser signals. A valid, "sensor-passed" _abck is what tells Akamai you are a real browser. An HTTP client never runs that JavaScript, so it either has no _abck or a rejected one, and every request is scored as a bot. You cannot forge a valid one from static code; it has to be produced by a real browser executing the sensor script.
Is a residential proxy alone enough to get past Akamai?
Usually not on its own. A residential IP clears the reputation layer, which matters because Akamai heavily penalizes datacenter ASNs - but if the site also checks your TLS fingerprint and requires valid sensor data, a clean IP by itself still gets scored as a bot. On Akamai-protected targets you typically need the residential IP and a real browser together. The IP is necessary, not sufficient.
Can I get past Akamai with curl_cffi instead of a full browser?
curl_cffi fixes one layer - it gives you a browser-accurate TLS fingerprint, so you clear the silent handshake check. But it does not run JavaScript, so it cannot generate the sensor data Akamai expects in _abck. On sites where Akamai only leans on IP and TLS, residential IP + curl_cffi can be enough. On sites that require sensor data, you need a real browser (Playwright/headless Chromium) routed through the residential proxy.
Is scraping an Akamai-protected site legal?
Scraping publicly available data is broadly permissible in many jurisdictions, but it is not a blanket right. Only collect public data, honor the site's robots.txt and terms where they apply, never scrape data behind a login you are not authorized to access, and rate-limit so you never degrade the service for real users. The methods here are for legitimate data collection, not for overwhelming a site.
Akamai scores the exit IP before it looks at anything else, and a datacenter ASN starts you in the hole. Roam residential IPs - rotating at $2/GB, static at $4/IP per month, over HTTP and SOCKS5 - give Akamai a real home-broadband ASN to score. Create an account and get 300MB of free trial traffic to test against your target.