Your scraper gets past the AWS WAF page check, the aws-waf-token cookie is set, and then the sign-up or checkout POST comes back 405 with "Request not allowed due to WAF captcha". The token is fine. It is the wrong kind: the page only ran a challenge, and that action is behind a CAPTCHA rule. Send jsapi.js instead of challenge.js and the same request goes through. CapBypass solves either kind in about 1.5 s on average.

Challenge vs CAPTCHA in AWS WAF

AWS WAF has two actions a rule can apply, and both end in the same aws-waf-token cookie:

Challenge CAPTCHA

What the visitor sees nothing, or a short interstitial an image or audio puzzle

Script challenge.js jsapi.js

Host pattern *.token.awswaf.com , *.sdk.awswaf.com *.captcha.awswaf.com , *.captcha-sdk.awswaf.com

Blocked response 202 with a challenge page 405 with a CAPTCHA page

Typical use page loads, browsing, search sign-up, login, checkout, forms

The token is not a single pass/fail flag.…