How to scrape CardMarket in 2026 (complete guide)

CardMarket is the European reference for buying and selling collectible cards (Pokémon, Magic, Yu-Gi-Oh and others). Its pages are packed with price data that's valuable for tracking the value of a card or a set. But access is locked twice over: Cloudflare in front, and a logged-in session to see the offer details. Here's how to approach collection cleanly.

What data you can collect on CardMarket

• Prices: lowest price, average price, trend, by edition and by condition.
• Offers: sellers, available quantities, card language and condition.
• Sellers: public reputation, shipping country.
• Catalog: mapping of card, set, number, rarity.

This data feeds collection valuation tools and value tracking over time.

What blocks a naive scraper

Two obstacles stack up:

• Cloudflare: the famous "Just a moment…" page. Cloudflare makes the browser solve a series of small JavaScript challenges, including a deliberately expensive computation. Without a real JavaScript engine, the request only gets an empty shell.
• The login: the offer details and certain pages are only visible with an authenticated session. A plain anonymous HTTP client only sees a partial version.

A Cloudflare challenge cookie is tied to the fingerprint of the client that obtained it: reusing it from another tool doesn't work. CardMarket requires a real browser.

To understand why the cookie can't be recycled, see our article on TLS fingerprinting.

How to get the data cleanly

WyndPath handles Cloudflare with a real browser, and knows how to maintain a session (cookies) for the targets that require it, configured at the target level. On the call side, you simply request the URL:

curl -G "https://api.wyndpath.com/v1/" \
  --data-urlencode "api_key=YOUR_KEY" \
  --data-urlencode "url=https://www.cardmarket.com/fr/Pokemon/Products/Singles" \
  --data-urlencode "render_js=1"

WyndPath detects that the target is behind Cloudflare and switches to the browser route automatically. Billing stays pay-per-success: if the challenge page isn't cleared, no credits are charged.

For the offer details, a logged-in session is required. It works self-service: on the first call to a page that requires it, WyndPath replies that credentials are needed. You then enter your own CardMarket credentials, once, in your console (the target's section) — they're encrypted and only used for your own calls. From then on, WyndPath logs in for you and replays the session on the following calls, without you having to handle a single cookie.

The legal framework

The displayed prices are public, but CardMarket has terms of use and its database is the result of an investment, so it's potentially protected by the sui generis right. Stay at reasonable volumes, respect robots.txt, and don't extract a substantial part of the database. Our article web scraping and the GDPR in France details the limits worth knowing.