> For the complete documentation index, see [llms.txt](https://docs.hypersolutions.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hypersolutions.co/incapsula/reese84.md).

# Reese84

Reese84 is the core Incapsula / Imperva check. A hidden JavaScript sensor collects device, canvas, and timing entropy and expects a **signed reese84 payload** posted back before it issues a valid `reese84` token. Our [Incapsula & Imperva Bypass API](https://hypersolutions.co/products/incapsula) generates that payload for you from a single HTTP call.

A site uses reese84 if the browser holds a cookie named **`reese84`**, or if you see an **`x-d-token`** header on its requests.

{% hint style="info" %}
This page covers the **static** reese84 sensor that runs in the background with no challenge page. If the site instead shows a **"Pardon Our Interruption"** page, it uses the dynamic variant with an extra Proof of Work step, see [Reese84 Dynamic](/incapsula/reese84-dynamic.md).
{% endhint %}

#### Locating the Script Path

The reese84 script is served from an obscure path unique to each site. Find it by inspecting network requests in your browser's developer tools and looking for POST requests whose URL contains `?d=`, these are sensor submissions. The corresponding script path is **static per site**, so you only need to find it once.

#### Implementation Steps

**Step 1: Fetch the Script Content**

Make a GET request to the script URL (the path you located above, including its query parameters). Store the full response body, our API requires the script content to generate a valid sensor.

```http
GET /path/to/reese84/script?s=... HTTP/2
Chrome: Headers
Accept: */*
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
```

**Step 2: Generate the Sensor**

Pass the script content and your session inputs to our API to generate the sensor. The SDKs wrap this in a single call:

{% tabs %}
{% tab title="Golang" %}
{% code overflow="wrap" %}

```go
sensor, err := session.GenerateReese84Sensor(ctx, &hyper.ReeseInput{
    UserAgent:      userAgent,
    AcceptLanguage: "en-US,en;q=0.9",
    IP:             ip,          // must match your egress IP
    ScriptUrl:      scriptUrl,   // full script URL, including ?s=...
    PageUrl:        pageUrl,
    Script:         scriptBody,  // full body from Step 1
    // Pow is only used by the dynamic variant, leave empty here
})
if err != nil {
    // Handle the error
}
```

{% endcode %}
{% endtab %}

{% tab title="Python" %}
{% code overflow="wrap" %}

```python
sensor = session.generate_reese84_sensor(hyper_sdk.ReeseInput(
    user_agent=user_agent,
    accept_language="en-US,en;q=0.9",
    ip=ip,                  # must match your egress IP
    script_url=script_url,  # full script URL, including ?s=...
    pageUrl=page_url,       # note: this kwarg is camelCase in the Python SDK
    script=script_body,     # full body from Step 1
))
```

{% endcode %}
{% endtab %}

{% tab title="JS / TS" %}
{% code overflow="wrap" %}

```javascript
import { Reese84Input, generateReese84Sensor } from "hyper-sdk-js";

// Constructor is positional: (userAgent, ip, acceptLanguage, pageUrl, script, scriptUrl, pow?)
const sensor = await generateReese84Sensor(
    session,
    new Reese84Input(userAgent, ip, "en-US,en;q=0.9", pageUrl, scriptBody, scriptUrl)
);
```

{% endcode %}
{% endtab %}
{% endtabs %}

{% hint style="warning" %}
The input class is named **`ReeseInput`** in Go and Python, but **`Reese84Input`** in JS/TS.
{% endhint %}

The input fields:

| Field (Go)       | Python            | JS ctor arg      | Description                                                                                        |
| ---------------- | ----------------- | ---------------- | -------------------------------------------------------------------------------------------------- |
| `UserAgent`      | `user_agent`      | `userAgent`      | Your browser's User-Agent (consistent across all requests)                                         |
| `AcceptLanguage` | `accept_language` | `acceptLanguage` | Your `Accept-Language` header value                                                                |
| `IP`             | `ip`              | `ip`             | Your public IP, which **must** match the egress IP the target sees                                 |
| `ScriptUrl`      | `script_url`      | `scriptUrl`      | The full script URL from Step 1 (with `?s=...`)                                                    |
| `PageUrl`        | `pageUrl`         | `pageUrl`        | The URL of the protected page (note: camelCase in the Python SDK)                                  |
| `Script`         | `script`          | `script`         | The full script body from Step 1                                                                   |
| `Pow`            | `pow`             | `pow`            | Proof of Work value, empty unless the [dynamic](/incapsula/reese84-dynamic.md) variant requires it |

If you'd rather implement the API call yourself, see the [API Reference](/api-reference/incapsula.md).

**Step 3: Submit the Sensor**

Submit the generated sensor to the script path with `?d=yourdomain.com` appended:

```http
POST /path/to/reese84/script?d=www.example.com HTTP/2
Chrome: Headers
Content-Type: text/plain; charset=utf-8

[YOUR_GENERATED_SENSOR]
```

**Step 4: Store the Cookie**

Parse the token from the response and save it as a cookie named `reese84`:

```json
{
  "token": "3:abc123...",
  "renewInSec": 896,
  "cookieDomain": "www.example.com"
}
```

Set the cookie with the domain from the response, then use it in subsequent requests to the protected site.

#### Notes

* The script path is static per site, locate it once and reuse it.
* The token expires after `renewInSec` seconds. Implement renewal before expiration.
* Use consistent headers, User-Agent, and TLS fingerprint across all requests.