Create free account Dashboard

Bot detection API for headless browsers, automation and AI agents

Our script checks the browser behind each signup, login or checkout. When it finds a script driving it, such as headless Chrome, Puppeteer or Playwright, your server gets device.automation: true and block, with the reasons. There is no CAPTCHA: your app decides what happens.

Create free account View API docs
  • Free plan: 10,000 visitor checks a month
  • No card
  • Paid plans from €29 a month
Example checkA headless browser at home
Blockrisk_score 83
Automation
Detected
Fake browser
Detected
VPN
Not detected
Proxy
Not detected
Connection
Residential
Country
United States
"decision": "block""reasons": ["antidetect_browser", "automation_detected"]
The public sample for a bot visit: the network is clean, the browser gives it away. See the JSON

What a check tells your server

device.automation
A script drives the browser, such as headless Chrome, Puppeteer, Playwright or Selenium, when the evidence is found. Block, with the reason automation_detected.
device.antidetect
A fake or tampered browser, with a tampering_score from 0 to 1. Block, with the reason antidetect_browser.
device.emulator
An emulated phone blocks (emulator_detected). A virtual machine on its own is review (virtual_machine): developers and remote desktops use them too.
network
VPN, proxy, Tor and cloud-server flags in the same answer, so you see the browser and the connection together.

Add it in front of your form

Put the check in front of whatever the bots hit: signup, login, checkout or any form post. Load https://maskbreak.com/assets/sentinel.js on the page and give the form the class monocle-enriched; your server sends the two fields it adds to /v1/evaluate before the action runs. The example starts in watch mode: it logs each verdict and lets every request through, even when Maskbreak can’t be reached. Once the log matches Events in your dashboard, uncomment the enforce line; the integration guide has the full checks. To weigh it against CAPTCHA services and bot managers, read Bot Detection APIs Compared.

Your server
// Score the request before the protected action runs
// Watch mode first: log the verdict, always continue, fail open
const body = req.body || {};  // sentinel.js adds monocle + sentinel_fp to your form
let risk = null;
try {
  const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', {
    method: 'POST',
    signal: AbortSignal.timeout(5000),
    headers: {
      'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      token: body.token || body.monocle,  // network evidence
      fingerprintEventId: body.fingerprintEventId || body.sentinel_fp,  // device evidence
      tz: body.tz || body.sentinel_tz
    })
  });
  if (verdictRes.ok) risk = await verdictRes.json();
} catch {}  // unreachable or timed out: your handler still runs
console.log('[maskbreak]', JSON.stringify({
  decision: risk?.decision ?? null, reasons: risk?.reasons ?? null,
  risk_score: risk?.risk_score ?? null, degraded: risk ? !!risk.degraded : null,
  automation: risk?.device?.automation ?? null
}));
// Enforce later: if (risk?.device?.automation) return res.status(403).json({ error: 'Request rejected' });

What it can’t see

People doing the work by hand
A paid worker at a real browser shows real human signals. You catch that on volume and on devices that come back, not on automation flags.
An agent in a person’s own browser
An AI agent that drives someone’s everyday browser, instead of a headless one, can look like that person.
Bots that never load your page
A script that posts straight to your API never runs our script, so the answer has no device part. Check for it before you treat a result as clean.

Common questions

Does Maskbreak detect Puppeteer and Playwright with stealth plugins?

It returns device.automation and automation_detected when automation evidence is found. Stealth tools change over time and no detector catches every patched browser, so test the versions and settings you worry about; Detecting Puppeteer and Playwright shows how.

Do I still need a CAPTCHA?

Maskbreak shows no CAPTCHA: it returns a decision and its reasons to your server. You choose whether a review answer gets an extra step, such as an email code.

Will good bots like Googlebot get blocked?

Only if you point the check at them. Maskbreak scores the flows you choose, such as signups, logins and checkouts, not your public pages, and search crawlers don’t submit your signup form.

Check your forms for bots

Setup starts in watch mode, so nobody is blocked until you turn blocking on.

Create free account Read the docs