How Kasada scores requests
Kasada is a gatekeeper proxy: every request flows through it before it reaches the origin (the real server). It serves a JavaScript file — named ips.js, but renamed on each deployment so its name keeps changing (polymorphic). That file hands the browser a proof-of-work challenge: a math puzzle that needs real CPU cycles and real browser APIs to solve. When the browser finishes, it gets a token (x-kpsdk-ct). Each token works only once — sending the same one twice is an instant red flag.
The standout 2026 detection trick: Kasada runs Function.prototype.toString() on dozens of built-in browser functions (such as navigator.webdriver, WebGLRenderingContext.getParameter, and HTMLCanvasElement.toDataURL). Calling toString() on a genuine browser function returns function () { [native code] }. But if a stealth tool like playwright-stealth has rewritten that function in JavaScript to hide automation, toString() returns function () { [custom code] } instead — and Kasada has the full set of these patched signatures on file.
Signals Kasada weighs
playwright-stealth — every patch it applies leaves a toString() trail. Those signatures are catalogued, which is why JavaScript-layer patching is detectable here.
undetected-chromedriver on its own — it changes the webdriver flag, but not the wider set of functions Kasada inspects with toString().
Datacenter proxies — Kasada weighs IP reputation heavily. Addresses from cloud providers (AWS, GCP, DigitalOcean ASNs — the network blocks a hosting company owns) carry low trust regardless of the browser configuration.
Token replay — x-kpsdk-ct tokens are single-use, so a repeated token is itself a signal.
How tools interact with it
PatchRight is frequently referenced in 2026 because it edits the Playwright Python source before Chrome starts, so its changes never exist as JavaScript inside the running browser. With nothing modified in the JS runtime, there is nothing for toString() to read at that layer.
SeleniumBase UC mode is another option that adjusts the WebDriver flag and can complete the proof-of-work challenge automatically.
Context that affects outcomes: IP reputation (residential or ISP static IPs versus datacenter addresses), token handling (each challenge token is single-use), and session distribution all factor into how Kasada scores traffic, on top of the browser configuration itself.