Integrations & SDKs

Add the script and the server call

1. The script, on the page with your form

<script async src="https://maskbreak.com/assets/sentinel.js"></script>

<form class="monocle-enriched" method="POST" action="/signup">
  <!-- Your fields stay as they are. The script adds monocle and sentinel_fp. -->
</form>

A form your JavaScript submits calls await Sentinel.collect() and sends the token and fingerprintEventId it returns with the form data. If your site sends a Content-Security-Policy header, add the sources listed in the integration guide.

2. The check, from your server

// Watch mode: send the check, log the answer, let every visitor through.
app.post('/signup', express.urlencoded({ extended: false }), async (req, res, next) => {
  try {
    const response = await fetch('https://maskbreak.com/v1/evaluate', {
      method: 'POST',
      headers: {
        Authorization: 'Bearer ' + process.env.MASKBREAK_API_KEY,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        token: req.body.monocle,                // the network check
        fingerprintEventId: req.body.sentinel_fp // the browser check
      }),
      signal: AbortSignal.timeout(3000)
    });
    const result = await response.json();
    console.log('[maskbreak]', JSON.stringify({ status: response.status,
      decision: result.decision, reasons: result.reasons, error: result.error }));
  } catch (error) {
    console.log('[maskbreak] check failed:', error.name);
  }
  next(); // your own handler still runs, whatever the answer
}, existingSignupHandler);

Submit your form once: the check appears under Events in the console, which says if half of it did not arrive. When the log lines look right, switch to enforce mode: stop block, hold review, a missing half, test answers and errors, and continue unchecked only while the month’s checks are used up (monthly_quota_exceeded). The integration guide has that handler, both modes behind one MASKBREAK_MODE switch.

Add what your server already knows

The same call takes optional fields. Take them from your server’s own records, never from the form, and send only the ones you have.

accountId

Your ID for the account being signed into or created. Maskbreak links devices and addresses to it for your account only; three or more of your accounts on one device within a day turn allow into review (device_many_accounts).

event

"login" with loginSucceeded returns an account takeover score: a high score turns allow into review, never block. "signup", "password_change", "verification", "logout" and "account_change" are recorded. On unless switched off in Settings.

email, phone

A throwaway-mailbox check and, with email and phone intelligence on, a 0–100 score for each, within your plan’s daily email and phone checks (Free 3, Starter 20, Growth 50, Scale 150). On by default for accounts created since 23 October 2026; older accounts switch it on in Settings.

tz

The browser’s time zone (sentinel_tz on enriched forms). One that does not fit the address’s country adds timezone_mismatch.

A score that did not run says checked: false; treat it as no opinion. After a test submission, GET /v1/setup with your key says whether the check arrived complete and what to fix next.

Guides for your framework

Each guide adds the same script and server call to one framework or platform, starting in watch mode.

Other ways in

• Server SDKsNode npm install @sentinelsup/sdk (npm, source), Python pip install sentinelsup (PyPI, source), PHP composer require sentinelsup/sdk (Packagist, source). They wrap the same call, not the script. From Node 0.5.0, Python 0.4.0 and PHP 0.3.0 they also send the optional fields and read /v1/setup.
• Cloudflare WorkersAn example Worker guards a POST route in front of your origin, in watch mode until you set MASKBREAK_MODE=enforce: setup, worker.mjs, wrangler.jsonc.
• StripeCheck the visitor before you create the PaymentIntent or Checkout Session; in enforce mode a review, block or unavailable check pauses the payment, and Stripe’s own checks and 3D Secure still apply. The pre-intent handler is in the integration guide.
• MCPThe hosted HTTP MCP endpoint looks up addresses and service status for AI agents. It does not collect browser evidence or perform full visitor checks; see the MCP API reference.
• iOS and AndroidThere is no shipped native Maskbreak SDK. A web flow in a WebView can load the script like a web page (check that both values arrive in each WebView you support), and the API key stays on your server, never in the app.
• No account yetThe public key sk_test_sandbox with a test token such as test_clean returns synthetic answers that check no real visitor: sandbox scenarios.

Storage on your site

The script and the checks it loads use the browser storage below, for fraud prevention and security only, never for advertising or analytics, and the values are opaque. List it in your own cookie policy and privacy notice, and decide whether your rules on storing information on a visitor’s device require consent before the script runs (DPA Section 3).

Both checks send what they collect, with the visitor’s IP address, to our network-intelligence and device-intelligence providers in the United States (sub-processors). Maskbreak also keeps a pseudonymous, service-wide count of how often a device has been seen (times_seen), described in our Privacy Policy. Names can change when a detection script is updated: check your pages in the browser’s developer tools before you publish your cookie policy.