Cloudbypass API Review 2026
Request-forwarding bypass API · Cloudflare JS Challenge, Turnstile, Imperva · bundled rotating proxies
A capable, well-documented bypass API with its pricing and its credit maths published in full.
- Pricing published in full, from a $49 entry plan to $1,056, with no quote-only wall
- Credit maths you can model: V1 = 1 credit, V2 = 3, failed requests free, FIFO consumption
- Proxy mode drops into an existing scraper without a rewrite, and four official SDKs plus an open GitHub repo back it
- API credits run on a 30-day plan window, while proxy traffic packages never expire
- Free trial credits are there to test a target first, and purchases are final once completed
- The official documentation is published under the Scrapingbypass brand
Cloudbypass is a request-forwarding HTTP API, and a proxy-mode endpoint, that handles Cloudflare JS Challenge, Cloudflare Turnstile and Imperva/Incapsula checks at the protocol level and returns the verified HTML or JSON, bundled with its own rotating residential and datacenter proxy pools.
It is not a classic CAPTCHA-solving farm. The stated design goal is to avoid triggering the challenge rather than to click through it, and it works entirely at the HTTP request level: no real browser is ever launched, so it is built for HTTP clients rather than browser-automation stacks such as Selenium and Puppeteer. Integration is either the API endpoint api.cloudbypass.com with x-cb-apikey and x-cb-host headers, or a plain HTTP proxy at proxy.cloudbypass.com:1087 using the API key as the username.
By the numbers
Figures taken from the Cloudbypass pricing, FAQ and docs pages at time of writing. The "$0.35 per 1,000 verifications" figure is the vendor's own headline rate; the effective cost per request depends on whether you use V1 (1 credit) or V2 (3 credits). Session partitions run 0-999, giving up to 1,000 concurrent sessions per account.
How it actually works
Four things decide what Cloudbypass costs you and how it plugs in: the integration mode, the API version, the session model and the Turnstile flow.
Two integration modes
In API mode you send your request to api.cloudbypass.com with the x-cb-apikey and x-cb-host headers, and Cloudbypass replays it against the target. In proxy mode you point an ordinary HTTP client at proxy.cloudbypass.com:1087 and use the API key as the proxy username, which means existing scraper code needs no rewrite. Both modes are documented with working examples in cURL, Python, Go, Node.js and Java.
V1 vs V2, and what each costs
V1 is stateless, ships with a built-in rotating proxy and costs 1 credit per successful request. It is the documented path for plain 403 responses. V2 performs JavaScript rendering plus polling, costs 3 credits (1 request plus 2 JS-polling) and requires a separate proxy that you either supply yourself or buy from Cloudbypass. V2 is the path for JS Challenge and Turnstile. The FAQ states that failed requests are not charged, and credits are consumed FIFO.
Session partitions and cf_clearance
Session partition values run 0-999. A partition locks a proxy IP, a fingerprint and a cf_clearance cookie together for 10 minutes, and each successful request refreshes that window, so repeat requests inside a session do not re-trigger verification.
Cloudbypass extracts the cf_clearance cookie automatically, binds it to the matching User-Agent and JA3, and renews it before expiry. Documented error codes include INSUFFICIENT_BALANCE, CHALLENGE_LOCK_OCCUPIED (the partition is already handling a challenge) and FORBIDDEN / V3 challenge failed, each with a recommended fix.
Turnstile tokens
For Turnstile you pass the target's x-cb-sitekey and Cloudbypass returns a verified challenge token you inject into the form, including the silent/invisible mode variant.
Pricing
All figures are published on the Cloudbypass pricing page at time of writing. API credit plans carry 30-day validity; a 3-month billing toggle and a "Contact Us for a Custom Plan" tier (unlimited credits, dedicated servers, higher concurrency) also exist. Proxy traffic is sold separately and, per the site, never expires.
API credit plans (30-day validity)
| Plan | Price | Credits | Concurrency |
|---|---|---|---|
| Basic | $49 | 80,000 credits | 20 req/s |
| Standard | $79 | 300,000 credits | 20 req/s |
| Advanced | $129 | 1,000,000 credits | 25 req/s |
| Pro | $259 | 2,200,000 credits | 25 req/s |
| Premium | $489 | 4,600,000 credits | 30 req/s |
| Ultimate | $1,056 | 12,000,000 credits | 30 req/s |
The FAQ states that all API plans currently support up to 30 concurrent requests per second, and each plan card lists the rate that goes with it at 20, 25 or 30 req/s.
Rotating datacenter traffic
Rotating residential traffic
Proxy traffic is billed on upload plus download volume and there are no monthly subscription plans for proxies. Payment methods shown on the site are Alipay and USDT icons in the footer; the refund page also names Stripe (Alipay). A free-trial package advertised as +200 API credits plus rotating proxy traffic is claimable from the console within 30 days of registering.
What it covers
The targets, clients and request-level knobs named in Cloudbypass's own documentation.
Anti-bot systems named on the site
Marketing copy also names Akamai. Cloudflare JS Challenge, Turnstile and Imperva/Incapsula are the systems with documented handling.
SDKs and clients
Request-level controls
Key characteristics
The details that shape how it fits a working stack.
Drop-in proxy mode
An existing scraper can route through proxy.cloudbypass.com:1087 without being re-plumbed into an API envelope.
Sessions that stick
Partition pinning matters more than raw solve speed when you are paginating a protected site.
Metering you can model
You can build a cost model before you spend.
Fingerprint control
JA3/JA4, HTTP/2 frame priority and the User-Agent pool are the levers that decide whether a request looks organic.
Real developer surface
SDKs, TypeScript types, public docs, an open GitHub example repo, and a console Code Generator that tells you whether a target URL can be bypassed before you commit budget.
Bundled proxy pools
Rotating residential and datacenter proxies over HTTP and SOCKS5, with country, state and city targeting and 1-30 minute rotation, sold as never-expiring traffic rather than subscriptions.
Multi-language storefront
Eight languages (English, Simplified and Traditional Chinese, Russian, Vietnamese, Spanish, Japanese, Korean). Docs are English and Chinese only; support runs in English and Chinese.
Telegram-first support
@cloudbypasscom sits in every navigation dropdown and the footer, with support@cloudbypass.com as the email channel.
Who it is for
The fit is decided by your stack and your procurement rules more than by your target list.
Good fit
- Teams running HTTP-level scrapers in Python, Node.js, Go or Java that keep hitting Cloudflare 403s and JS Challenges.
- Anyone who wants a proxy-mode drop-in rather than rewriting a codebase around a new API envelope.
- Projects that need predictable per-request costing and can model V1/V2 credit burn in advance.
- Workloads with session-continuity requirements, such as paginated catalogs and logged-out browsing flows, where a pinned IP and cf_clearance for 10 minutes beats raw throughput.
- Developers who want to test a target URL first using the console Code Generator and the advertised free-trial credits.
Worth checking first
- Stacks built on Selenium or Puppeteer: the service works at the HTTP level and never launches a real browser.
- Credits run on a 30-day plan window, so size the plan against a known monthly workload.
- Mainland China users on a direct connection, which the FAQ says cannot reach the service.
- Payment is shown as Alipay and USDT, with Stripe referenced in the refund agreement.
- The free trial credits are the way to test a target before buying a plan.
Good to know
Practical details worth having before you wire this into a production pipeline.
| Topic | What the site shows |
|---|---|
| Credit validity | API credits run on the 30-day plan window, so buy credits to match a known workload. The proxy traffic packages, by contrast, never expire. |
| Refunds and the free trial | The refund agreement states that packages bought with Stripe/Alipay or virtual currency are final, and the free trial is offered as the way to try the service first. |
| Documentation brand | The official docs and the footer "Guides" link are published under the Scrapingbypass brand (scrapingbypass.com), and the documentation text says "Scrapingbypass API" throughout. |
| HTTP request level | The service runs entirely at the HTTP request level and never launches a real browser, so it pairs with HTTP clients rather than Selenium or Puppeteer. V2 also needs a separate proxy that you supply or buy from Cloudbypass, so budget that alongside the credit price. |
| Payment options | Alipay and USDT are displayed on the site, and Stripe is referenced in the refund agreement. |
| Mainland China access | The FAQ states that mainland China users cannot reach the service on a direct connection. |
| Support channels | Telegram (@cloudbypasscom) and support@cloudbypass.com. |
What Cloudbypass publishes
What the site documents, and the quickest way to get going.
Published
Full API credit pricing and proxy traffic pricing, credit consumption rules (V1 = 1, V2 = 3, failures free, FIFO), concurrency figures, session partition behaviour, error codes with fixes, the two integration endpoints, SDK packages on PyPI and npm, public docs at docs.cloudbypass.com, an open GitHub example repo, fourteen use-case pages, a technical blog, the refund agreement, and Telegram plus email support contacts.
Getting started
Free-trial credits and the console Code Generator let you check whether a target URL is bypassable before you buy. The docs, the four official SDKs and the GitHub example repo cover integration in Python, Node.js, Go and Java, and proxy mode drops into an existing scraper without a rewrite. Questions go to Telegram at @cloudbypasscom or support@cloudbypass.com.
Using Cloudbypass API with PROXIES.SX mobile proxies
The practical hook is V2. Cloudbypass's own docs say the JavaScript-rendering path used for JS Challenge and Turnstile requires a separate proxy, either one you supply or one you buy from Cloudbypass. That is a bring-your-own-IP slot, and it is where proxies.sx 4G/5G mobile IPs fit: Cloudbypass handles the TLS fingerprint, HTTP/2 framing, cf_clearance lifecycle and challenge token, and your proxy decides what network the request appears to come from. Carrier-grade mobile IPs sit behind CGNAT with thousands of real subscribers, a different reputation profile from a datacenter range.
The arithmetic is worth doing first. Cloudbypass's bundled residential traffic runs $2.57/GB down to $1.11/GB and its datacenter traffic $1.22/GB down to $0.35/GB, both cheaper per gigabyte than our $4/GB dropping to $2.40/GB at volume. If price per GB is the only variable, use theirs.
The reason to bring mobile IPs instead is IP type, not IP price. Mobile carrier ranges behave differently from residential and datacenter ranges under anti-bot scoring, so on targets where the datacenter or residential pool keeps failing, changing the network layer is the lever left to pull. GB never expire on PROXIES.SX and endpoints are free, so an experimental mobile lane costs nothing to keep open while Cloudbypass handles the protocol work.
Either way, measure the pairing on your own targets: the free-trial credits and the console Code Generator tell you whether a given URL is bypassable before you buy either side.
Cloudbypass
Protocol layer - JA3/JA4 fingerprint, HTTP/2 framing, JS Challenge and Turnstile handling, cf_clearance lifecycle.
PROXIES.SX
Network layer - 4G/5G mobile and residential IPs for the V2 bring-your-own-proxy slot. GB never expire, endpoints free.
Session discipline
Partition 0-999 pinning keeps one IP, one fingerprint and one cf_clearance together for the 10-minute window.
Where it fits
On engineering, Cloudbypass is well put together. Pricing is published rather than hidden behind a quote form, the credit maths are stated plainly, four official SDKs and public docs back it, and the console Code Generator tells you whether a target is bypassable before you spend. The proxy-mode endpoint is a genuinely low-friction integration, and the 0-999 session partitions with 10-minute cf_clearance pinning solve a real problem for session-continuity workloads.
It suits HTTP-level scraping teams in Python, Node.js, Go or Java who want a drop-in bypass layer with costs they can model in advance. Credits run on a 30-day window and the free trial is how you test first, so start with the trial credits, size the first plan against a known workload, and keep the proxy traffic packages, which never expire, for the V2 bring-your-own-proxy slot.
Related reviews
Cloudbypass facts reflect the vendor's own published pricing, FAQ, documentation and refund pages at time of writing (verified via cloudbypass.com and docs.cloudbypass.com). Performance figures such as the 95%+ bypass rate, 1,200+ teams, 90M+ rotating IPs, 99% IP uptime and sub-200ms latency are as published by the vendor. Cloudbypass's refund agreement states that Stripe/Alipay and virtual-currency purchases cannot be refunded. Readers are responsible for their own legal and contractual compliance. Outbound links to cloudbypass.com and t.me/cloudbypasscom use rel="nofollow sponsored noopener noreferrer".