Reese84

Reese84 is Imperva / Incapsula's core bot check: a hidden JavaScript sensor that expects a signed payload before it issues a valid reese84 token.

Reese84 is the core Incapsula / Imperva check. A hidden JavaScript sensor collects device, canvas, and timing entropy and expects a signed reese84 payload posted back before it issues a valid reese84 token. Our Incapsula & Imperva Bypass API generates that payload for you from a single HTTP call.

A site uses reese84 if the browser holds a cookie named reese84, or if you see an x-d-token header on its requests.

This page covers the static reese84 sensor that runs in the background with no challenge page. If the site instead shows a "Pardon Our Interruption" page, it uses the dynamic variant with an extra Proof of Work step, see Reese84 Dynamic.

Locating the Script Path

The reese84 script is served from an obscure path unique to each site. Find it by inspecting network requests in your browser's developer tools and looking for POST requests whose URL contains ?d=, these are sensor submissions. The corresponding script path is static per site, so you only need to find it once.

Implementation Steps

Step 1: Fetch the Script Content

Make a GET request to the script URL (the path you located above, including its query parameters). Store the full response body, our API requires the script content to generate a valid sensor.

GET /path/to/reese84/script?s=... HTTP/2
Chrome: Headers
Accept: */*
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Step 2: Generate the Sensor

Pass the script content and your session inputs to our API to generate the sensor. The SDKs wrap this in a single call:

Golang

sensor, err := session.GenerateReese84Sensor(ctx, &hyper.ReeseInput{
    UserAgent:      userAgent,
    AcceptLanguage: "en-US,en;q=0.9",
    IP:             ip,          // must match your egress IP
    ScriptUrl:      scriptUrl,   // full script URL, including ?s=...
    PageUrl:        pageUrl,
    Script:         scriptBody,  // full body from Step 1
    // Pow is only used by the dynamic variant, leave empty here
})
if err != nil {
    // Handle the error
}

Python

sensor = session.generate_reese84_sensor(hyper_sdk.ReeseInput(
    user_agent=user_agent,
    accept_language="en-US,en;q=0.9",
    ip=ip,                  # must match your egress IP
    script_url=script_url,  # full script URL, including ?s=...
    pageUrl=page_url,       # note: this kwarg is camelCase in the Python SDK
    script=script_body,     # full body from Step 1
))

JS / TS

import { Reese84Input, generateReese84Sensor } from "hyper-sdk-js";

// Constructor is positional: (userAgent, ip, acceptLanguage, pageUrl, script, scriptUrl, pow?)
const sensor = await generateReese84Sensor(
    session,
    new Reese84Input(userAgent, ip, "en-US,en;q=0.9", pageUrl, scriptBody, scriptUrl)
);

The input class is named ReeseInput in Go and Python, but Reese84Input in JS/TS.

The input fields:

Field (Go)	Python	JS ctor arg	Description
UserAgent	user_agent	userAgent	Your browser's User-Agent (consistent across all requests)
AcceptLanguage	accept_language	acceptLanguage	Your Accept-Language header value
IP	ip	ip	Your public IP, which must match the egress IP the target sees
ScriptUrl	script_url	scriptUrl	The full script URL from Step 1 (with ?s=...)
PageUrl	pageUrl	pageUrl	The URL of the protected page (note: camelCase in the Python SDK)
Script	script	script	The full script body from Step 1
Pow	pow	pow	Proof of Work value, empty unless the dynamic variant requires it

If you'd rather implement the API call yourself, see the API Reference.

Step 3: Submit the Sensor

Submit the generated sensor to the script path with ?d=yourdomain.com appended:

POST /path/to/reese84/script?d=www.example.com HTTP/2
Chrome: Headers
Content-Type: text/plain; charset=utf-8

[YOUR_GENERATED_SENSOR]

Step 4: Store the Cookie

Parse the token from the response and save it as a cookie named reese84:

{
  "token": "3:abc123...",
  "renewInSec": 896,
  "cookieDomain": "www.example.com"
}

Set the cookie with the domain from the response, then use it in subsequent requests to the protected site.

Notes

• The script path is static per site, locate it once and reuse it.

• The token expires after renewInSec seconds. Implement renewal before expiration.

• Use consistent headers, User-Agent, and TLS fingerprint across all requests.