VPN detection API that names the VPN when it’s known

// Server-side only (Node 18+, Express). Runs before your existing login handler.
// 'watch' (default): log what Maskbreak would do, always continue.
// 'enforce': stop block; hold review, missing evidence and errors
// (a used-up month excepted: logged, then the login continues).
const MASKBREAK_MODE = process.env.MASKBREAK_MODE || 'watch';

app.post('/login', async (req, res, next) => {
  const token = req.body.token || req.body.monocle;
  const fingerprintEventId = req.body.fingerprintEventId || req.body.sentinel_fp;
  let result = null, hold = null, monthUsedUp = false;

  if (!token) {
    hold = [409, 'Verification required.'];
  } else {
    try {
      const response = await fetch('https://maskbreak.com/v1/evaluate', {
        method: 'POST',
        signal: AbortSignal.timeout(5000),
        headers: {
          Authorization: 'Bearer ' + process.env.MASKBREAK_API_KEY,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ token, fingerprintEventId, tz: req.body.tz || req.body.sentinel_tz })
      });
      if (!response.ok) {
        const refusal = await response.json().catch(() => null);
        // The month's checks are used up: let the login through, logged, until the 1st.
        if (response.status === 429 && refusal?.code === 'monthly_quota_exceeded') monthUsedUp = true;
        else throw new Error('Evaluation unavailable');
      } else {
        result = await response.json();
        if (!['allow', 'review', 'block'].includes(result.decision) ||
            result.test || result.sample || result.sandbox) throw new Error('Not a live verdict');

        if (result.decision === 'block') hold = [403, 'Request declined.'];
        else if (result.decision === 'review' || result.degraded) {
          hold = [409, 'Verification required.']; // e.g. send an email code
        }
      }
    } catch {
      hold = [503, 'Verification unavailable. Try again.'];
    }
  }

  console.log('[maskbreak]', JSON.stringify({
    mode: MASKBREAK_MODE, decision: result?.decision ?? null, reasons: result?.reasons ?? null,
    enforce_would: hold ? 'return ' + hold[0] : monthUsedUp ? 'continue (month used up)' : 'continue'
  }));
  if (MASKBREAK_MODE === 'enforce' && hold) return res.status(hold[0]).json({ error: hold[1] });
  return next(); // watch mode, or allow: your normal login runs
}, existingLoginHandler);

# pip install sentinelsup   (Flask shown; any framework works)
import json
import os
from flask import request, abort
from sentinel import Sentinel, SentinelError

maskbreak = Sentinel(api_key=os.environ["MASKBREAK_API_KEY"])
MODE = os.environ.get("MASKBREAK_MODE", "watch")  # watch: log only; enforce: act on it

@app.post("/login")
def login():
    result, hold = None, None
    try:
        result = maskbreak.evaluate(
            token=request.form.get("monocle", ""),
            fingerprint_event_id=request.form.get("sentinel_fp"),
        )
        if result.test:
            hold = 400  # a test token must never pass a live action
        elif result.decision == "block":
            hold = 403
        elif result.decision == "review" or result.raw.get("degraded"):
            hold = "verify"
    except SentinelError as e:  # missing token, timeout or API error
        # The month's checks are used up: let the login through, logged, until the 1st.
        if e.status == 429 and e.body.get("code") == "monthly_quota_exceeded":
            hold = None
        else:
            hold = 503

    print("[maskbreak]", json.dumps({  # one line per check, whatever your log level
        "mode": MODE, "decision": getattr(result, "decision", None),
        "reasons": getattr(result, "reasons", None), "enforce_would": hold or "continue",
    }), flush=True)
    if MODE == "enforce" and hold == "verify":
        return send_email_code(request.form["email"])  # your extra step
    if MODE == "enforce" and hold:
        abort(hold)
    return existing_login()  # watch mode, or allow: your normal login runs

<?php
// composer require sentinelsup/sdk
$mode = getenv('MASKBREAK_MODE') ?: 'watch'; // watch: log only; enforce: act on it
$maskbreak = new \Sentinel\Client(getenv('MASKBREAK_API_KEY') ?: null);
$result = null;
$hold = null;

try {
    $result = $maskbreak->evaluate([
        'token' => $_POST['monocle'] ?? '',
        'fingerprintEventId' => $_POST['sentinel_fp'] ?? '',
    ]);
    if ($result->test) { $hold = 400; } // never on a live action
    elseif ($result->decision === 'block') { $hold = 403; }
    elseif ($result->decision === 'review' || !empty($result->raw['degraded'])) { $hold = 'verify'; }
} catch (\Sentinel\SentinelException $e) { // missing token, timeout or API error
    // The month's checks are used up: let the login through, logged, until the 1st.
    $monthUsedUp = $e->getStatus() === 429 && ($e->getBody()['code'] ?? null) === 'monthly_quota_exceeded';
    $hold = $monthUsedUp ? null : 503;
}

error_log('[maskbreak] ' . json_encode([
    'mode' => $mode, 'decision' => $result->decision ?? null,
    'reasons' => $result->reasons ?? null, 'enforce_would' => $hold ?? 'continue',
]));
if ($mode === 'enforce' && $hold === 'verify') {
    send_email_code($_POST['email']); // your extra step
    exit;
}
if ($mode === 'enforce' && $hold) { http_response_code($hold); exit; }
// watch mode, or allow: your normal login continues here