Cloudbypass API Review 2026
Request-forwarding bypass API · Cloudflare JS Challenge, Turnstile, Imperva · bundled rotating proxies
Cloudbypass is a request-forwarding HTTP API - and a proxy-mode endpoint - that handles Cloudflare JS Challenge, Cloudflare Turnstile and Imperva/Incapsula checks at the protocol level and returns the verified HTML or JSON, bundled with its own rotating residential and datacenter proxy pools. It is not a classic CAPTCHA-solving farm: the stated design goal is to avoid triggering the challenge rather than to click through it, and it works entirely at the HTTP request level - Selenium and Puppeteer are explicitly not supported because no real browser is ever launched. Integration is either the API endpoint api.cloudbypass.com with x-cb-apikey and x-cb-host headers, or a plain HTTP proxy at proxy.cloudbypass.com:1087 using the API key as the username. Pricing is published in full, credits are metered transparently (V1 = 1 credit, V2 = 3 credits, failures not charged), and there are official Python, Node.js, Go and Java SDKs plus an open GitHub example repo. The trade-offs are real and we cover them below: no legal entity is disclosed anywhere on the site, the refund agreement is effectively zero-refund, API credits expire after 30 days, and the official docs carry a different brand name that is never explained.
By the numbers
Figures taken from the Cloudbypass pricing, FAQ and docs pages at time of writing. The "$0.35 per 1,000 verifications" figure is the vendor's own headline rate; the effective cost per request depends on whether you use V1 (1 credit) or V2 (3 credits). Session partitions run 0-999, giving up to 1,000 concurrent sessions per account.
How it actually works
Two integration modes
In API mode you send your request to api.cloudbypass.com with the x-cb-apikey and x-cb-host headers, and Cloudbypass replays it against the target. In proxy mode you point an ordinary HTTP client at proxy.cloudbypass.com:1087 and use the API key as the proxy username, which means existing scraper code needs no rewrite. Both modes are documented with working examples in cURL, Python, Go, Node.js and Java.
V1 vs V2, and what each costs
V1 is stateless, ships with a built-in rotating proxy and costs 1 credit per successful request. It is the documented path for plain 403 responses. V2 performs JavaScript rendering plus polling, costs 3 credits (1 request plus 2 JS-polling) and requires a separate proxy that you either supply yourself or buy from Cloudbypass. V2 is the path for JS Challenge and Turnstile. The FAQ states that failed requests are not charged, and credits are consumed FIFO.
Session partitions and cf_clearance
Session partition values run 0-999. A partition locks a proxy IP, a fingerprint and a cf_clearance cookie together for 10 minutes, and each successful request refreshes that window, so repeat requests inside a session do not re-trigger verification. Cloudbypass extracts the cf_clearance cookie automatically, binds it to the matching User-Agent and JA3, and renews it before expiry. Documented error codes include INSUFFICIENT_BALANCE, CHALLENGE_LOCK_OCCUPIED (the partition is already handling a challenge) and FORBIDDEN / V3 challenge failed, each with a recommended fix.
Turnstile tokens
For Turnstile you pass the target's x-cb-sitekey and Cloudbypass returns a verified challenge token you inject into the form, including the silent/invisible mode variant.
Pricing
All figures are published on the Cloudbypass pricing page at time of writing. API credit plans carry 30-day validity; a 3-month billing toggle and a "Contact Us for a Custom Plan" tier (unlimited credits, dedicated servers, higher concurrency) also exist. Proxy traffic is sold separately and, per the site, never expires.
API credit plans (30-day validity)
| Plan | Price | Credits | Concurrency |
|---|---|---|---|
| Basic | $49 | 80,000 credits | 20 req/s |
| Standard | $79 | 300,000 credits | 20 req/s |
| Advanced | $129 | 1,000,000 credits | 25 req/s |
| Pro | $259 | 2,200,000 credits | 25 req/s |
| Premium | $489 | 4,600,000 credits | 30 req/s |
| Ultimate | $1,056 | 12,000,000 credits | 30 req/s |
Note the discrepancy worth knowing before you size a plan: the FAQ says all API plans currently support up to 30 concurrent requests per second, while the individual plan cards list 20, 25 or 30 req/s. Confirm which applies to your plan before committing.
Rotating datacenter traffic
Rotating residential traffic
Proxy traffic is billed on upload plus download volume and there are no monthly subscription plans for proxies. Payment methods shown on the site are Alipay and USDT icons in the footer; the refund page also names Stripe (Alipay). A free-trial package advertised as +200 API credits plus rotating proxy traffic is claimable from the console within 30 days of registering.
What it covers
Anti-bot systems named on the site
Marketing copy also names Akamai. Cloudflare JS Challenge, Turnstile and Imperva/Incapsula are the systems with documented handling.
SDKs and clients
Request-level controls
Key characteristics
Drop-in proxy mode
A standard HTTP proxy at proxy.cloudbypass.com:1087 with the API key as the username means an existing scraper can route through it without a rewrite - a lower-friction path than re-plumbing every call into an API envelope.
Sessions that stick
Partitions 0-999 pin a proxy IP, fingerprint and cf_clearance together for 10 minutes, refreshed by each success. That matters more than raw solve speed when you are paginating a protected site.
Metering you can model
V1 = 1 credit, V2 = 3 credits, failures free, FIFO consumption. You can build a cost model before you spend, which is more than many bypass vendors publish.
Fingerprint control
Configurable JA3/JA4 TLS fingerprints, HTTP/2 frame-priority simulation, a desktop and mobile User-Agent pool, Referer and custom headers - the levers that actually decide whether a request looks organic.
Real developer surface
Official Python, Node.js, Go and Java SDKs, TypeScript types, public docs, an open GitHub example repo, and a console Code Generator that tells you whether a target URL can be bypassed before you commit budget.
Bundled proxy pools
Rotating residential and datacenter proxies over HTTP and SOCKS5 with country, state and city targeting and 1-30 minute rotation, sold as never-expiring traffic packages rather than subscriptions.
Multi-language storefront
Eight storefront languages (English, Simplified and Traditional Chinese, Russian, Vietnamese, Spanish, Japanese, Korean). Docs are English and Chinese only; support runs in English and Chinese.
Telegram-first support
@cloudbypasscom appears in every navigation dropdown and the footer, with support@cloudbypass.com as the email channel. There is no ticket system and no published response-time commitment.
Who it is for
Good fit
- Teams running HTTP-level scrapers in Python, Node.js, Go or Java that keep hitting Cloudflare 403s and JS Challenges.
- Anyone who wants a proxy-mode drop-in rather than rewriting a codebase around a new API envelope.
- Projects that need predictable per-request costing and can model V1/V2 credit burn in advance.
- Workloads with session continuity requirements - paginated catalogs, logged-out browsing flows - where a pinned IP and cf_clearance for 10 minutes is worth more than raw throughput.
- Developers who want to test a target URL first using the console Code Generator and the advertised free-trial credits.
Poor fit
- Stacks built on Selenium or Puppeteer - explicitly unsupported, because the service never launches a real browser.
- Buyers who need a named legal counterparty, an invoice, a VAT ID or a signed SLA. None of those are published.
- Anyone who needs a refund path: the refund agreement says Stripe/Alipay and crypto purchases cannot be refunded in any form.
- Teams with lumpy usage - API credits die with the 30-day plan window, so a quiet month is money burned.
- Mainland China users on a direct connection, who the FAQ says cannot connect at all and are warned that buying anyway is non-refundable.
- Procurement processes that require card, PayPal or invoicing terms - only Alipay and USDT logos are displayed.
Honest limitations
These are the things we would want to know before wiring a production pipeline to Cloudbypass. None of them are dealbreakers on their own; together they set the risk posture.
- No legal entity, anywhere. There is no company name, registration number, VAT ID or postal address on the site. The footer copyright line renders literally as "Copyright . All rights reserved." with no owner and no year. If a dispute arises, there is no disclosed counterparty to raise it with.
- Zero-refund policy. The refund agreement states that packages bought with Stripe/Alipay or virtual currency "cannot be refunded in any form", and reserves final interpretation to Cloudbypass. The free trial is offered as the substitute for a money-back guarantee - so use it properly before you buy.
- Credits expire in 30 days. Unused API credits are lost when the plan validity ends. The proxy traffic packages, by contrast, never expire. Buy credits to match a known workload, not as stock.
- Brand identity is muddled. The official docs and the footer "Guides" link point to a different brand, Scrapingbypass (scrapingbypass.com), and the documentation text says "Scrapingbypass API" throughout. The relationship between the two brands is never explained on either site.
- Translation and copy quality. The refund page contains an untranslated internal brand name ("All ChuanYun products offer free trials"), and several pages carry machine-translation artefacts - signals of a Chinese-origin site whose English copy has not been fully proofed.
- Self-reported numbers, unverifiable social proof. The 95%+ bypass rate, 1,200+ teams, 90M+ IPs, 99% uptime and sub-200ms latency figures come with no methodology, sample or third-party audit. The testimonials are anonymous placeholders labelled "User A", "User B" and "User C" with job titles only.
- Geo claims contradict each other. The proxy page states "200+ countries and regions" in its stat bar and "195+ countries" for residential a few sections further down the same page.
- No SLA, no status page. Despite the 99% and 95% figures used in marketing, there is no uptime guarantee document and no public status page.
- No browser automation. Selenium and Puppeteer are explicitly unsupported. V2 also requires you to supply or buy a separate proxy, so the headline credit price is not the whole cost.
- Narrow payment options. Only Alipay and USDT logos are displayed; Stripe is mentioned only inside the refund text. No card logos, no PayPal, no invoicing terms shown.
- Support is Telegram and email only. No ticket system, no response-time commitment, no phone number.
- Compliance risk sits with you. The product exists to defeat WAF and CAPTCHA protections. The terms of service cap liability at the fees paid in the previous month and include the line "This service is for research purposes only", with only a generic "comply with relevant laws" disclaimer beyond that.
What is and isn't published
To keep this review honest, here is the line between what Cloudbypass states and what it does not. We do not infer numbers or policies it has not given.
- Published: full API credit pricing and proxy traffic pricing, credit consumption rules (V1 = 1, V2 = 3, failures free, FIFO), concurrency figures, session partition behaviour, error codes with fixes, the two integration endpoints, SDK packages on PyPI and npm, public docs at docs.cloudbypass.com, an open GitHub example repo, fourteen use-case pages, a technical blog, the refund agreement, and Telegram plus email support contacts.
- Not published: any legal entity, registration number, VAT ID or address; an SLA or uptime guarantee document; a public status page; a founding date; the relationship to the Scrapingbypass brand that its own docs carry; a methodology behind the 95%, 99%, 90M+ and 1,200+ headline figures; card, PayPal or invoicing payment options; and any response-time commitment for support.
Using Cloudbypass API with PROXIES.SX mobile proxies
The practical hook is V2. Cloudbypass's own docs say V2 - the JavaScript-rendering path used for JS Challenge and Turnstile - requires a separate proxy, either one you supply or one you buy from Cloudbypass. That is a bring-your-own-IP slot, and it is exactly where proxies.sx 4G/5G mobile IPs fit: Cloudbypass handles the TLS fingerprint, HTTP/2 framing, cf_clearance lifecycle and challenge token, and your proxy decides what network the request appears to come from. Carrier-grade mobile IPs are shared behind CGNAT with thousands of real subscribers, which is a fundamentally different reputation profile from a datacenter range.
Be clear-eyed about the economics rather than the marketing. Cloudbypass's own bundled residential traffic runs $2.57/GB down to $1.11/GB and its datacenter traffic $1.22/GB down to $0.35/GB - both cheaper per gigabyte than our $4/GB dropping to $2.40/GB at volume. If price per GB is the only variable, use theirs. The reason to bring mobile IPs instead is IP type, not IP price: mobile carrier ranges behave differently from residential and datacenter ranges under anti-bot scoring, and on targets where the datacenter or residential pool keeps failing, changing the network layer is the lever left to pull. On PROXIES.SX, GB never expire and endpoints are free, so an experimental mobile lane costs you nothing to keep open while Cloudbypass handles the protocol work.
One honest caveat: we have not independently benchmarked Cloudbypass against our pool, and Cloudbypass publishes no methodology behind its 95% figure. Treat any pairing as something to measure on your own targets - use the free-trial credits and the console Code Generator to check whether a given URL is bypassable at all before you buy either side.
Cloudbypass
Protocol layer - JA3/JA4 fingerprint, HTTP/2 framing, JS Challenge and Turnstile handling, cf_clearance lifecycle.
PROXIES.SX
Network layer - 4G/5G mobile and residential IPs for the V2 bring-your-own-proxy slot. GB never expire, endpoints free.
Session discipline
Partition 0-999 pinning keeps one IP, one fingerprint and one cf_clearance together for the 10-minute window.
Verdict
On engineering, Cloudbypass is stronger than most of the category. Pricing is published in full rather than hidden behind a quote form, the credit maths are stated plainly (V1 = 1 credit, V2 = 3, failures free), there are official SDKs for four languages, public docs, an open GitHub example repo, and a console Code Generator that tells you whether a target is bypassable before you spend. The proxy-mode endpoint is a genuinely low-friction integration, and the 0-999 session partitions with 10-minute cf_clearance pinning solve a real problem that raw solve-rate marketing usually ignores. The fingerprint controls - JA3/JA4, HTTP/2 frame priority, User-Agent pool - are the right levers.
The deductions are governance, not capability. No legal entity is disclosed anywhere and the footer copyright line has no owner and no year. The refund agreement is effectively zero-refund for every payment method it names. API credits expire after 30 days while proxy traffic does not, which quietly penalises lumpy usage. The official docs carry a different brand name, Scrapingbypass, and neither site explains the relationship. Headline numbers are self-reported, the testimonials are "User A" and "User B", and the geo claims contradict each other on a single page. Selenium and Puppeteer are unsupported, so this is not a drop-in for browser-automation stacks. Our read: a capable, well-documented tool worth trialling with the free credits and sizing conservatively - but treat every purchase as non-recoverable, keep plan sizes matched to known workload, and do not build a contractual dependency on a vendor that has not named itself.
Related reviews
Cloudbypass facts reflect the vendor's own published pricing, FAQ, documentation and refund pages at time of writing (verified via cloudbypass.com and docs.cloudbypass.com). Performance figures such as the 95%+ bypass rate, 1,200+ teams, 90M+ rotating IPs, 99% IP uptime and sub-200ms latency are self-reported by the vendor and have not been independently verified by PROXIES.SX; no methodology, sample or third-party audit is published. No legal entity, SLA document, status page or founding date is published, and those gaps are marked as such rather than inferred. Cloudbypass's own terms state the service is "for research purposes only" and cap liability at the fees paid in the previous month; its refund agreement states that Stripe/Alipay and virtual-currency purchases cannot be refunded in any form. Bypassing WAF, CAPTCHA and anti-bot protections may breach the terms of service of the sites you target and may be restricted in your jurisdiction - readers are responsible for their own legal and contractual compliance. Outbound links to cloudbypass.com and t.me/cloudbypasscom use rel="nofollow sponsored noopener noreferrer".