Free VPN Detection API: Check VPNs and Proxies on Your Website

Need a free VPN detection API for your website? Maskbreak is free during open beta: 1,000 visitor checks per hour per API key, with no credit card. It checks live visits for VPN, proxy and Tor signals and returns an allow, review or block decision. This is an API for detecting VPN use, not for providing a VPN connection.

The free offer is an open-beta allowance, not a promise of free service forever. Existing keys receive at least 30 days’ notice before paid changes. See the current limits and terms. Inspect a sample response without an account, or create an account for a live API key.

Free VPN and proxy detection APIs: which fits your input?

The first choice is what you can send: an IP address from your server logs, or evidence collected during a live browser visit. Those inputs are not interchangeable. The options below are a shortlist, not an accuracy ranking. Official documentation was checked on September 9, 2026; confirm each provider’s current allowance and commercial-use terms before integrating.

Maskbreak: live visitor checks with a decision

Use the browser SDK and POST /v1/evaluate for VPN and residential-proxy checks, with the VPN or proxy service in network.service when known. Optional device evidence adds browser-tampering and automation signals. The response includes a decision, risk score and reasons. See the integration example and response reference.

Limit to know: Maskbreak’s production bare-IP lookup currently checks Tor exits and cloud-server ranges. It does not provide the live VPN/proxy assessment. If you only have historical IP addresses and need VPN flags for them, evaluate an IP-based service below.

IPQualityScore: IP-based VPN and proxy checks

IPQS documents VPN, proxy and Tor detection from an IP address, alongside a fraud score and network information. That input model can suit server logs or an application without a browser collector. Read the official Proxy & VPN Detection API documentation and confirm your account’s current free allowance and commercial terms before choosing.

ip-api: a limited option for non-commercial projects

The free JSON endpoint provides geolocation, a combined proxy/VPN/Tor flag and a hosting flag. It is HTTP-only and limited to 45 requests per minute per IP address; see the JSON endpoint documentation. Its free-service terms restrict use to non-commercial environments, so it is not a free commercial fraud-prevention option.

vpnapi.io: separate network flags from an IP address

vpnapi.io documents separate security.vpn, security.proxy, security.tor and security.relay flags. Its documentation lists 1,000 daily API requests for a free account. Check the official response fields and rate limits for the current offer. Your application decides what to do with those flags.

Maskbreak VPN detection API vs IP lookup

Read the IP lookup reference for its separate response shape. A false VPN flag from that endpoint is not proof that an address is outside a VPN. For the full distinction, see proxy detection API vs IP lookup.

Set up a live VPN and proxy check

Create a free account, copy your live key from the dashboard, and store it as SENTINEL_KEY in your server’s environment. The browser loads the collector without a secret. Keep the live API key out of HTML, browser JavaScript and public source repositories.

1. Collect evidence in the visitor’s browser

Add this script to the page containing your existing signup form:

<script defer src="https://maskbreak.com/assets/sentinel.js"></script>

After the SDK loads, collect evidence in your form’s submit handler and include these fields with the form data you already send to your own backend:

// Inside your existing async submit handler, after event.preventDefault().
const { token, fingerprintEventId, tz } = await window.Sentinel.collect();
const response = await fetch('/your-signup-endpoint', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    ...formData, // your existing signup fields
    token, fingerprintEventId, tz
  })
});
// Handle response.status in your existing signup UI.

The network token is required for the live VPN/proxy assessment. fingerprintEventId adds device evidence when available. Handle collector errors in your form UI; missing evidence must not silently authorize the signup.

2. Evaluate on your server before completing the action

This Node 22 / Express example plugs into an existing application. app, express and existingSignupHandler belong to your app. Keep its normal validation, authentication, rate limiting and abuse controls.

app.use(express.json({ limit: '16kb' }));
app.post('/your-signup-endpoint', async (req, res, next) => {
  try {
    const { token, fingerprintEventId, tz } = req.body;
    const response = await fetch('https://maskbreak.com/v1/evaluate', {
      method: 'POST',
      signal: AbortSignal.timeout(2000), // example budget; measure yours
      headers: {
        'Authorization': 'Bearer ' + process.env.SENTINEL_KEY,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ token, fingerprintEventId, tz })
    });
    if (!response.ok) throw new Error('Visitor check unavailable');
    const result = await response.json();
    if (result.test || result.sandbox || result.sample) {
      throw new Error('Synthetic result in production');
    }
    if (!['allow', 'review', 'block'].includes(result.decision)) {
      throw new Error('Unexpected verdict');
    }
    if (result.decision === 'block') {
      return res.status(403).json({ error: 'Action refused by policy' });
    }
    if (result.decision === 'review' || result.degraded) {
      // Your app must complete a real step-up or manual review here.
      return res.status(409).json({ next: 'step_up' });
    }
    req.fraudCheck = result;
    return next(); // continue normal signup validation
  } catch {
    // Example temporary hold; choose a fallback for your business action.
    return res.status(503).json({ error: 'Check unavailable; try again shortly' });
  }
}, existingSignupHandler);

The example holds a signup when the check fails. A 409 response only requests your application’s review flow; it does not implement a challenge. If your action needs a different timeout or fallback, define it explicitly. The full quickstart and timeout guide cover the integration context.

How to use VPN detection without rejecting every VPN user

A VPN signal describes a connection, not a person’s intent. Under Maskbreak’s default evaluation policy, a VPN alone produces review, not block. Customer rules and exceptions can change the final decision. Read decision and reasons; do not turn isSuspicious or network.vpn into an automatic rejection.

For explanations, use network.vpn, network.proxy and network.tor. network.service names the VPN or proxy service when known and can be null. If degraded: true is present, false network flags mean evidence was unavailable. Optional device fields may also be absent. See the response reference.

What to test before relying on a free tier

• Response handling: use test_clean, test_vpn, test_proxy and test_tor with the public sandbox key in a separate test environment. Fixtures check your code paths; they do not measure detection coverage.
• Controlled live visits: compare a direct connection, your own VPN and an authorized residential proxy. Record which evidence was available and whether the resulting action fits your policy.
• Missing evidence: test a blocked collector, a missing token, a timeout and an unavailable device layer. None should become a successful check by accident.
• Quota handling: test 429 responses and respect Retry-After. Size for your busiest hour; Maskbreak’s evaluate and lookup calls share the hourly allowance.

Use the sandbox documentation and VPN API test cases to make these checks repeatable.

Which should you choose?

For a website that can collect live browser evidence and needs a decision at signup or login, start with Maskbreak’s open beta. For historical IPs or a system without a browser, compare providers that document VPN detection from an address. Check the commercial terms, the exact fields available on your plan and how your application handles unknown results.

Start with 1,000 visitor checks per hour during open beta, with no card. Or inspect the response first. Review the current free offer and change-notice terms before choosing.