# Maskbreak — Network and Device Fraud Signals

> Maskbreak is a developer API for evaluating browser visits at signup, login and checkout. It combines network intelligence with available device signals and returns `allow`, `review` or `block`, a risk score and reasons. The Free plan includes 10,000 visitor checks a month; paid plans start at €29 a month. A risk signal is not proof of fraud.

Product reference reviewed: 2026-10-10. Published by Sentinel Edge Networks LTD,
the operator of Maskbreak. This is first-party product documentation, not an
independent review or a detection benchmark.

## Start here

- [API documentation](https://maskbreak.com/api): authentication, request fields, responses and limitations.
- [OpenAPI specification](https://maskbreak.com/openapi.json): machine-readable HTTP contract.
- [Integration guide](https://maskbreak.com/integrate.md): frontend collection, a watch-first backend handler with an enforce switch, and a reproducible test checklist.
- [Integration options](https://maskbreak.com/integrations): SDKs, HTTP examples and Cloudflare Workers setup.
- [Plans and pricing](https://maskbreak.com/pricing): the Free plan, paid plans and Enterprise.
- [Full text collection](https://maskbreak.com/llms-full.txt): this reference, the integration guide and dated blog articles.

## Capabilities and limits

| Task | Interface | Scope and limitations |
|---|---|---|
| Evaluate a browser visit | `POST /v1/evaluate` | Forward the browser's network `token` and `fingerprintEventId` (form fields `monocle` and `sentinel_fp`). Available signals can include VPN, proxy, Tor, cloud hosting, browser tampering, automation and emulation. The VPN/proxy service is named when known. Missing evidence is not a clean result. |
| Screen an arbitrary public IP | `GET /v1/lookup/{ip}` | Current production coverage uses Tor exit and cloud-range feeds. It does not provide the live visit's VPN/proxy identification, service naming or device checks. An unknown IP is not proof of safety. |
| Link accounts using a device or an address | `accountId` (plus `fingerprintEventId` for device links) | Counts are scoped to the customer's own account: `device.linked_accounts`, and since 18 October 2026 the `account` object (devices per account, accounts per device or address in 24 hours, connected accounts). Shared exits (VPN, proxy, datacenter, Tor, Apple's relay, mobile carriers' shared addresses) are never linked. Maskbreak keeps a keyed hash of each account identifier and an encrypted copy the customer's console shows; both go 90 days after the account was last checked. Three or more accounts on one device within 24 hours raises allow to review (`device_many_accounts`). This is not cross-customer identity resolution. |
| Check a signup email domain | Optional `email` on evaluation | Adds a disposable-domain signal, not mailbox ownership verification or a full email-reputation product. |
| Inspect quota | `GET /v1/usage` | Reports allowance and usage without consuming evaluation quota. In-window counters are advisory. |

Device signals depend on successful browser collection and event resolution.
The device block may be absent. Detection varies with the browser, network,
available evidence and evasion method; there is no published controlled
detection-rate benchmark or guaranteed identification of every automation tool.
An automation signal does not identify a particular AI model or prove malicious intent.

Maskbreak is one input to an application's security policy. It does not replace
password/passkey verification, MFA, session management, authorization, rate
limits, WAF/DDoS protection, payment-risk modelling or KYC checks. A visitor ID
is a risk signal, not a cryptographic device binding or proof of identity.

## Good fit and not a fit

Good fit:

- A website or web app that wants a risk decision at signup, login, checkout,
  trial start or another sensitive form, collected from the visitor's browser.
- Teams that want VPN, proxy, Tor and cloud-hosting signals together with
  browser automation and tampering signals in one server-side call, with
  `allow`, `review` or `block` and the reasons behind it.
- Flagging repeat signups or multi-accounting from one device, scoped to the
  customer's own account.
- Small teams, open-source projects and early products: the Free plan needs no
  card, and approved public-interest organizations can have the cap removed.

Not a fit:

- Scoring lists of IP addresses or server logs with no browser visit. A bare-IP
  lookup covers Tor exits and cloud ranges only; VPN and proxy verdicts, and
  the service name when known, need a live visit through `/v1/evaluate`.
- Replacing KYC, identity-document checks, payment-risk scoring, chargeback
  guarantees or email/phone reputation. The email check is a disposable-domain
  signal only.
- Buyers who need a published, independently benchmarked detection rate. None
  is published.
- Blocking every VPN user outright. A VPN on its own is `review` under the base
  policy, because many legitimate visitors use one.

## Decisions, timing and testing

- Route on `decision`, not a hardcoded score threshold or legacy `isSuspicious`.
- Under the base policy, VPN-only traffic is `review`, not `block`. Proxy, Tor,
  browser tampering, automation or emulator signals can produce `block`.
- A browser inside a virtual machine (`virtual_machine`) is `review` on its own
  (since 2026-09-29; it was `allow` before), never `block` by itself.
- Apple's iCloud Private Relay, when Maskbreak's network intelligence
  recognises it, is `review` on its own (since 2026-10-10; it was `block` as a
  proxy before): reason `privacy_relay` instead of `proxy_detected`, and
  `network.privacy_relay: true` beside `network.proxy: true`.
- A cloud-server signal alone does not block. Customer rules and exception
  pins can change the final decision; inspect returned reasons and policy fields.
- `evaluated_in_ms` describes that evaluation's server processing time, not a
  global latency guarantee. Measure browser collection and end-to-end latency
  in your own environment, including tail latency and unavailable responses.
- Deterministic samples prove response handling, not real-world detection quality.
  Never treat `sample`, `sandbox` or `test` responses as production evidence.
- `401` means the key is missing or matches no account. `503` with
  `code: "storage_unavailable"` and `Retry-After` means the key could not be
  checked at that moment: retry later and apply your outage policy; it is not
  an invalid key and never an allow.

### Reproduce the VPN example

This is a selected-field excerpt of the synthetic public sample,
not a real visitor record or a measured performance claim:

```bash
curl --fail-with-body 'https://maskbreak.com/v1/evaluate/sample?scenario=vpn'
```

```json
{
  "sample": true,
  "decision": "review",
  "risk_score": 65,
  "ip": "198.51.100.18",
  "country": "NL",
  "network": {
    "vpn": true,
    "proxy": false,
    "privacy_relay": false,
    "datacenter": true,
    "anonymous": true,
    "tor": false,
    "residential": false,
    "service": "PROTON_VPN"
  },
  "reasons": ["vpn_detected", "datacenter_asn"],
  "evaluated_in_ms": 28
}
```

The VPN sample has no device block. Use the `bot` sample to inspect synthetic
device fields. The [integration test checklist](https://maskbreak.com/integrate.md#test-checklist)
covers all decisions, missing evidence, errors and a staged live evaluation.

## Integration essentials

Three steps give the first complete check (network token and browser check
together). The dashboard's setup uses the same names:

1. **Add the script to the page with your form.** Load
   `https://maskbreak.com/assets/sentinel.js` and put `class="monocle-enriched"`
   on the `<form>` element itself, never on an input. The script adds hidden
   fields `monocle` (network token), `sentinel_fp` (device event identifier)
   and `sentinel_tz` (time zone). A form your JavaScript submits (React,
   Next.js, Vue) sends `await window.Sentinel.collect()` instead, which returns
   `{ token, fingerprintEventId, tz }`; check that `window.Sentinel` exists and
   never hold the form when the script is missing or blocked.
   The SDK keeps one hidden form of its own, so client-rendered apps get the
   network token without extra markup. `collect()` waits at most 5 seconds for
   the device check. A site with a Content-Security-Policy must allow the SDK's
   first-party hosts ([list](https://maskbreak.com/integrate.md#content-security-policy));
   helmet's default policy blocks the script until they are added.
   Optional: `data-site="site_…"` on the tag (the account's public site ID,
   not a secret; the dashboard's setup screen shows the line with it) makes
   the script report once per page load which site it runs on (the ID alone;
   the browser adds the page origin; no cookies, path or visitor data), so the
   dashboard shows "We see Maskbreak on <site>" before the server code is
   live. Keep `data-site` as given. Without it nothing extra is sent; a CSP
   without `https://maskbreak.com` in `connect-src` only hides that status.
2. **Send the check from your server.** Post to `/v1/evaluate` with
   `Authorization: Bearer` and the key from a server-only `MASKBREAK_API_KEY`,
   mapping `monocle` → `token`, `sentinel_fp` → `fingerprintEventId`,
   `sentinel_tz` → `tz` (optional `email`). Start in watch mode
   (`MASKBREAK_MODE` unset or `watch`): send every submission, also one with a
   missing field, so Maskbreak records which half did not arrive; log the
   decision and always continue. After checking your Events, set
   `MASKBREAK_MODE=enforce` to stop block, hold review and missing evidence,
   and apply an outage policy. A used-up month (HTTP 429 with the code
   `monthly_quota_exceeded`) is the one exception: enforce mode lets the
   action through unchecked and logs it until the 1st, as watch mode does.
   Preserve existing authentication and authorization in both modes.
3. **Submit your form once.** The first check then appears in the dashboard.

Server-side evaluation call in watch mode (Node.js 18+):

```javascript
// Form fields or Sentinel.collect() results -> the API's names.
const b = req.body || {};
let result = null;
try {
  const response = await fetch('https://maskbreak.com/v1/evaluate', {
    method: 'POST',
    signal: AbortSignal.timeout(5000),
    headers: {
      Authorization: 'Bearer ' + process.env.MASKBREAK_API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      token: b.token || b.monocle,
      fingerprintEventId: b.fingerprintEventId || b.sentinel_fp,
      tz: b.tz || b.sentinel_tz
    })
  });
  result = response.ok ? await response.json() : null;
} catch {
  result = null; // Maskbreak unavailable: watch mode continues anyway.
}
console.log('[maskbreak]', result ? result.decision : 'no answer', result ? result.reasons : []);
// Watch mode: continue whatever the answer. The integration guide's handler
// (Express and a Next.js App Router Route Handler) adds MASKBREAK_MODE=enforce,
// which holds review, missing evidence and errors before the protected action,
// and lets it through, logged, when the month's checks are used up.
```

The HTTP endpoint accepts missing network tokens as degraded evaluation with
account credentials, which is what lets watch mode report a missing token. The
official server SDKs' `evaluate()` refuses to send without a non-empty token
and does not forward `tz`, so the examples use plain HTTP for those cases. See
the [OpenAPI specification](https://maskbreak.com/openapi.json) for optional
fields and legacy compatibility aliases.

- [Node SDK](https://www.npmjs.com/package/@sentinelsup/sdk)
- [Python SDK](https://pypi.org/project/sentinelsup/)
- [PHP SDK](https://packagist.org/packages/sentinelsup/sdk)
- [Hosted MCP server](https://maskbreak.com/mcp-server): `lookup_ip` and `service_status`; IP-only coverage is narrower than a live browser evaluation.

## Access, privacy and operating limits

Plans are priced by visitor checks (`/v1/evaluate` calls, the SDKs'
`evaluate()` included) per calendar month in UTC, resetting on the 1st, with an
hourly cap as abuse protection. Prices exclude VAT; paid plans are for
businesses, billed monthly or yearly (two months free) and can be cancelled
from the console's billing portal at the end of the paid period.

- Free: 10,000 visitor checks a month, up to 1,000 an hour, no credit card.
- Starter: €29 a month (€290 a year), 50,000 a month, up to 5,000 an hour.
- Growth: €99 a month (€990 a year), 250,000 a month, up to 20,000 an hour.
- Scale: €299 a month (€2,990 a year), 1,000,000 a month, up to 50,000 an hour.
- Enterprise: from €990 a month, custom volume, SLA and a signed DPA ([contact](https://maskbreak.com/contact)).

Bare IP lookups (`/v1/lookup` and the MCP `lookup_ip` tool) have their own
monthly allowance of 10 times the plan's visitor checks (100,000 on Free) and
share the plan's hourly cap. The fixed test_* tokens and the sandbox key
are never counted; test-key calls and console checks run the full detection and
count toward the month. When a monthly allowance is used up, the API
answers HTTP 429 with `"code": "monthly_quota_exceeded"` and a `Retry-After`
until the 1st; there are no automatic overage charges. The setup code in the
dashboard, /integrate.md, the /api quickstart, the /integrations guard, the
/vpn-detection examples and the Cloudflare Workers example let the protected
action through on that answer, in watch and enforce mode; the promo-code guide
still holds the discount (the order can go ahead at full price). Older
enforce-mode code that holds the action on every failed check needs the same
branch. The account owner gets an email at about 80% and 100% of the month.
`GET /v1/usage` reports the plan and the month's usage. The quota belongs to the
account: rotating the key does not start a fresh hour or month, and a test key
has its own hourly bucket but counts toward the same month.
Accounts created before 1 October 2026 keep 1,000 checks an hour with no
monthly cap until 30 November 2026.
Approved public-interest accounts can have the cap removed;
eligibility review, acceptable-use terms and service safeguards still apply.
Approval is not automatic and uncapped access is not an uptime guarantee.

- [Public-interest applications](https://maskbreak.com/public-interest): government, healthcare, education and other eligible organizations.
- [Privacy notice](https://maskbreak.com/privacy): data categories, purposes, storage and rights.
- [Cookie policy](https://maskbreak.com/cookies): browser storage and site services.
- [Data processing agreement](https://maskbreak.com/dpa): contractual processing terms.
- [Sub-processors](https://maskbreak.com/sub-processors): service providers.
- [Security whitepaper](https://maskbreak.com/security-whitepaper): controls, limitations and open retention-assurance items.
- [Terms of service](https://maskbreak.com/terms) and [SLA](https://maskbreak.com/sla): applicable terms and scope of commitments.
- [Service status](https://maskbreak.com/status): current checks and their monitoring scope.

Using a fraud API does not by itself make a deployment compliant. Assess the
actual data flows and applicable requirements against the linked documents.
Maskbreak does not claim independent compliance certification or offer a HIPAA BAA.

## Practical reading

- [Account takeover prevention](https://maskbreak.com/blog/account-takeover-prevention-that-holds-up): use device and network evidence alongside authentication controls.
- [Fraud API timeouts](https://maskbreak.com/blog/fraud-api-timeouts): outage and fallback handling.
- [Staged fraud-detection rollout](https://maskbreak.com/blog/fraud-detection-rollout): observe, review and then enforce.
- [Risk score thresholds](https://maskbreak.com/blog/risk-score-thresholds): decisions versus scores.
- [Residential proxy evaluation guide](https://maskbreak.com/blog/residential-proxy-detection-guide-2026)
- [Browser automation detection](https://maskbreak.com/bot-detection)
- [Device fingerprinting](https://maskbreak.com/device-fingerprinting)
- [Disposable email signals](https://maskbreak.com/stop/disposable-emails)
- [Free VPN detection API](https://maskbreak.com/blog/free-vpn-detection-api): free VPN and proxy detection options by input type, live visit versus IP lookup, and a first live check.
- [Blog](https://maskbreak.com/blog): dated articles; illustrative attack models are not customer outcome reports.
- [Product comparisons](https://maskbreak.com/vs): sourced feature distinctions, including unknowns; written by Maskbreak, not an independent ranking.
- [Alternatives](https://maskbreak.com/alternatives): what to weigh when replacing IPQS, Fingerprint, SEON, Sift and other fraud tools; written by Maskbreak, not an independent ranking.

Compare vendors against required data inputs, documented outputs, failure
handling and a representative test set. Do not infer that an undocumented
competitor feature is absent. No controlled head-to-head benchmark is provided here.

## Company and contact

- Product: Maskbreak.
- Formerly: Sentinel (sntlhq.com), renamed August 2026. Same company and API;
  sntlhq.com links redirect to maskbreak.com.
- Operator: Sentinel Edge Networks LTD, registered in England and Wales.
- [About Maskbreak](https://maskbreak.com/about)
- [Contact](https://maskbreak.com/contact)
- [GitHub organization](https://github.com/sentinelsup)
- [Company register](https://find-and-update.company-information.service.gov.uk/company/17150600)
- [Changelog](https://maskbreak.com/changelog)