Cloudbypass API Review 2026
Request-forwarding bypass API · Cloudflare JS Challenge, Turnstile, Imperva · bundled rotating proxies
A capable, well-documented bypass API with its pricing and its credit maths published in full, held back by a vendor that has never named itself.
- Pricing published in full, from a $49 entry plan to $1,056, with no quote-only wall
- Credit maths you can model: V1 = 1 credit, V2 = 3, failed requests free, FIFO consumption
- Proxy mode drops into an existing scraper without a rewrite, and four official SDKs plus an open GitHub repo back it
- No legal entity is disclosed anywhere on the site
- The refund agreement is effectively zero-refund for every payment method it names
- API credits expire with the 30-day plan window, and the official docs carry a different brand name
Cloudbypass is a request-forwarding HTTP API, and a proxy-mode endpoint, that handles Cloudflare JS Challenge, Cloudflare Turnstile and Imperva/Incapsula checks at the protocol level and returns the verified HTML or JSON, bundled with its own rotating residential and datacenter proxy pools.
It is not a classic CAPTCHA-solving farm. The stated design goal is to avoid triggering the challenge rather than to click through it, and it works entirely at the HTTP request level, so Selenium and Puppeteer are explicitly not supported: no real browser is ever launched. Integration is either the API endpoint api.cloudbypass.com with x-cb-apikey and x-cb-host headers, or a plain HTTP proxy at proxy.cloudbypass.com:1087 using the API key as the username.
By the numbers
Figures taken from the Cloudbypass pricing, FAQ and docs pages at time of writing. The "$0.35 per 1,000 verifications" figure is the vendor's own headline rate; the effective cost per request depends on whether you use V1 (1 credit) or V2 (3 credits). Session partitions run 0-999, giving up to 1,000 concurrent sessions per account.
How it actually works
Four things decide what Cloudbypass costs you and how it plugs in: the integration mode, the API version, the session model and the Turnstile flow.
Two integration modes
In API mode you send your request to api.cloudbypass.com with the x-cb-apikey and x-cb-host headers, and Cloudbypass replays it against the target. In proxy mode you point an ordinary HTTP client at proxy.cloudbypass.com:1087 and use the API key as the proxy username, which means existing scraper code needs no rewrite. Both modes are documented with working examples in cURL, Python, Go, Node.js and Java.
V1 vs V2, and what each costs
V1 is stateless, ships with a built-in rotating proxy and costs 1 credit per successful request. It is the documented path for plain 403 responses. V2 performs JavaScript rendering plus polling, costs 3 credits (1 request plus 2 JS-polling) and requires a separate proxy that you either supply yourself or buy from Cloudbypass. V2 is the path for JS Challenge and Turnstile. The FAQ states that failed requests are not charged, and credits are consumed FIFO.
Session partitions and cf_clearance
Session partition values run 0-999. A partition locks a proxy IP, a fingerprint and a cf_clearance cookie together for 10 minutes, and each successful request refreshes that window, so repeat requests inside a session do not re-trigger verification.
Cloudbypass extracts the cf_clearance cookie automatically, binds it to the matching User-Agent and JA3, and renews it before expiry. Documented error codes include INSUFFICIENT_BALANCE, CHALLENGE_LOCK_OCCUPIED (the partition is already handling a challenge) and FORBIDDEN / V3 challenge failed, each with a recommended fix.
Turnstile tokens
For Turnstile you pass the target's x-cb-sitekey and Cloudbypass returns a verified challenge token you inject into the form, including the silent/invisible mode variant.
Pricing
All figures are published on the Cloudbypass pricing page at time of writing. API credit plans carry 30-day validity; a 3-month billing toggle and a "Contact Us for a Custom Plan" tier (unlimited credits, dedicated servers, higher concurrency) also exist. Proxy traffic is sold separately and, per the site, never expires.
API credit plans (30-day validity)
| Plan | Price | Credits | Concurrency |
|---|---|---|---|
| Basic | $49 | 80,000 credits | 20 req/s |
| Standard | $79 | 300,000 credits | 20 req/s |
| Advanced | $129 | 1,000,000 credits | 25 req/s |
| Pro | $259 | 2,200,000 credits | 25 req/s |
| Premium | $489 | 4,600,000 credits | 30 req/s |
| Ultimate | $1,056 | 12,000,000 credits | 30 req/s |
One discrepancy worth knowing before you size a plan: the FAQ says all API plans currently support up to 30 concurrent requests per second, while the individual plan cards list 20, 25 or 30 req/s. Confirm which applies to your plan before committing.
Rotating datacenter traffic
Rotating residential traffic
Proxy traffic is billed on upload plus download volume and there are no monthly subscription plans for proxies. Payment methods shown on the site are Alipay and USDT icons in the footer; the refund page also names Stripe (Alipay). A free-trial package advertised as +200 API credits plus rotating proxy traffic is claimable from the console within 30 days of registering.
What it covers
The targets, clients and request-level knobs named in Cloudbypass's own documentation.
Anti-bot systems named on the site
Marketing copy also names Akamai. Cloudflare JS Challenge, Turnstile and Imperva/Incapsula are the systems with documented handling.
SDKs and clients
Request-level controls
Key characteristics
What stands out once you get past the marketing page.
Drop-in proxy mode
An existing scraper can route through proxy.cloudbypass.com:1087 without being re-plumbed into an API envelope.
Sessions that stick
Partition pinning matters more than raw solve speed when you are paginating a protected site.
Metering you can model
You can build a cost model before you spend, which is more than many bypass vendors publish.
Fingerprint control
JA3/JA4, HTTP/2 frame priority and the User-Agent pool are the levers that decide whether a request looks organic.
Real developer surface
SDKs, TypeScript types, public docs, an open GitHub example repo, and a console Code Generator that tells you whether a target URL can be bypassed before you commit budget.
Bundled proxy pools
Rotating residential and datacenter proxies over HTTP and SOCKS5, with country, state and city targeting and 1-30 minute rotation, sold as never-expiring traffic rather than subscriptions.
Multi-language storefront
Eight languages (English, Simplified and Traditional Chinese, Russian, Vietnamese, Spanish, Japanese, Korean). Docs are English and Chinese only; support runs in English and Chinese.
Telegram-first support
@cloudbypasscom sits in every navigation dropdown and the footer, with support@cloudbypass.com as the email channel. No ticket system, no published response-time commitment.
Who it is for
The fit is decided by your stack and your procurement rules more than by your target list.
Good fit
- Teams running HTTP-level scrapers in Python, Node.js, Go or Java that keep hitting Cloudflare 403s and JS Challenges.
- Anyone who wants a proxy-mode drop-in rather than rewriting a codebase around a new API envelope.
- Projects that need predictable per-request costing and can model V1/V2 credit burn in advance.
- Workloads with session-continuity requirements, such as paginated catalogs and logged-out browsing flows, where a pinned IP and cf_clearance for 10 minutes beats raw throughput.
- Developers who want to test a target URL first using the console Code Generator and the advertised free-trial credits.
Poor fit
- Stacks built on Selenium or Puppeteer, explicitly unsupported because the service never launches a real browser.
- Buyers who need a named legal counterparty, an invoice, a VAT ID or a signed SLA. None of those are published.
- Anyone who needs a refund path: the refund agreement says Stripe/Alipay and crypto purchases cannot be refunded in any form.
- Teams with lumpy usage. API credits die with the 30-day plan window, so a quiet month is money burned.
- Mainland China users on a direct connection, who the FAQ says cannot connect at all and are warned that buying anyway is non-refundable.
- Procurement processes that require card, PayPal or invoicing terms. Only Alipay and USDT logos are displayed.
Honest limitations
Things we would want to know before wiring a production pipeline to Cloudbypass. None are dealbreakers on their own; together they set the risk posture.
| Issue | What the site actually shows |
|---|---|
| No legal entity | No company name, registration number, VAT ID or postal address appears on the site. The footer copyright line renders literally as "Copyright . All rights reserved." with no owner and no year, so a dispute has no disclosed counterparty to raise it with. |
| Zero-refund policy | The refund agreement states that packages bought with Stripe/Alipay or virtual currency "cannot be refunded in any form", and reserves final interpretation to Cloudbypass. The free trial is offered as the substitute for a money-back guarantee, so use it properly before you buy. |
| Credits expire in 30 days | Unused API credits are lost when the plan validity ends. The proxy traffic packages, by contrast, never expire. Buy credits to match a known workload, not as stock. |
| Muddled brand identity | The official docs and the footer "Guides" link point to a different brand, Scrapingbypass (scrapingbypass.com), and the documentation text says "Scrapingbypass API" throughout. The relationship between the two brands is never explained on either site. |
| Translation and copy quality | The refund page contains an untranslated internal brand name ("All ChuanYun products offer free trials"), and several pages carry machine-translation artefacts: signals of a Chinese-origin site whose English copy has not been fully proofed. |
| Self-reported numbers | The 95%+ bypass rate, 1,200+ teams, 90M+ IPs, 99% uptime and sub-200ms latency figures come with no methodology, sample or third-party audit. The testimonials are anonymous placeholders labelled "User A", "User B" and "User C" with job titles only. |
| Geo claims contradict | The proxy page states "200+ countries and regions" in its stat bar and "195+ countries" for residential a few sections further down the same page. |
| No SLA, no status page | Despite the 99% and 95% figures used in marketing, there is no uptime guarantee document and no public status page. |
| No browser automation | Selenium and Puppeteer are explicitly unsupported. V2 also requires you to supply or buy a separate proxy, so the headline credit price is not the whole cost. |
| Narrow payment options | Only Alipay and USDT logos are displayed; Stripe is mentioned only inside the refund text. No card logos, no PayPal, no invoicing terms shown. |
| Support channels | Telegram and email only. No ticket system, no response-time commitment, no phone number. |
| Compliance risk sits with you | The product exists to defeat WAF and CAPTCHA protections. The terms of service cap liability at the fees paid in the previous month and include the line "This service is for research purposes only", with only a generic "comply with relevant laws" disclaimer beyond that. |
What is and isn't published
The line between what Cloudbypass states and what it does not. We do not infer numbers or policies it has not given.
Published
Full API credit pricing and proxy traffic pricing, credit consumption rules (V1 = 1, V2 = 3, failures free, FIFO), concurrency figures, session partition behaviour, error codes with fixes, the two integration endpoints, SDK packages on PyPI and npm, public docs at docs.cloudbypass.com, an open GitHub example repo, fourteen use-case pages, a technical blog, the refund agreement, and Telegram plus email support contacts.
Not published
Any legal entity, registration number, VAT ID or address; an SLA or uptime guarantee document; a public status page; a founding date; the relationship to the Scrapingbypass brand that its own docs carry; a methodology behind the 95%, 99%, 90M+ and 1,200+ headline figures; card, PayPal or invoicing payment options; and any response-time commitment for support.
Using Cloudbypass API with PROXIES.SX mobile proxies
The practical hook is V2. Cloudbypass's own docs say the JavaScript-rendering path used for JS Challenge and Turnstile requires a separate proxy, either one you supply or one you buy from Cloudbypass. That is a bring-your-own-IP slot, and it is where proxies.sx 4G/5G mobile IPs fit: Cloudbypass handles the TLS fingerprint, HTTP/2 framing, cf_clearance lifecycle and challenge token, and your proxy decides what network the request appears to come from. Carrier-grade mobile IPs sit behind CGNAT with thousands of real subscribers, a different reputation profile from a datacenter range.
Be clear-eyed about the economics. Cloudbypass's bundled residential traffic runs $2.57/GB down to $1.11/GB and its datacenter traffic $1.22/GB down to $0.35/GB, both cheaper per gigabyte than our $4/GB dropping to $2.40/GB at volume. If price per GB is the only variable, use theirs.
The reason to bring mobile IPs instead is IP type, not IP price. Mobile carrier ranges behave differently from residential and datacenter ranges under anti-bot scoring, so on targets where the datacenter or residential pool keeps failing, changing the network layer is the lever left to pull. GB never expire on PROXIES.SX and endpoints are free, so an experimental mobile lane costs nothing to keep open while Cloudbypass handles the protocol work.
One honest caveat: we have not independently benchmarked Cloudbypass against our pool, and Cloudbypass publishes no methodology behind its 95% figure. Treat any pairing as something to measure on your own targets - use the free-trial credits and the console Code Generator to check whether a given URL is bypassable at all before you buy either side.
Cloudbypass
Protocol layer - JA3/JA4 fingerprint, HTTP/2 framing, JS Challenge and Turnstile handling, cf_clearance lifecycle.
PROXIES.SX
Network layer - 4G/5G mobile and residential IPs for the V2 bring-your-own-proxy slot. GB never expire, endpoints free.
Session discipline
Partition 0-999 pinning keeps one IP, one fingerprint and one cf_clearance together for the 10-minute window.
Verdict
On engineering, Cloudbypass is stronger than most of the category. Pricing is published rather than hidden behind a quote form, the credit maths are stated plainly, four official SDKs and public docs back it, and the console Code Generator tells you whether a target is bypassable before you spend. The proxy-mode endpoint is a genuinely low-friction integration, and the 0-999 session partitions with 10-minute cf_clearance pinning solve a real problem that raw solve-rate marketing usually ignores.
The deductions are governance, not capability: no legal entity, a zero-refund agreement, credits that die at 30 days while proxy traffic does not, docs carrying the Scrapingbypass name, self-reported headline numbers, "User A" testimonials, geo claims that contradict each other on one page, and no Selenium or Puppeteer support. Our read: a capable, well-documented tool worth trialling with the free credits and sizing conservatively. Treat every purchase as non-recoverable, keep plan sizes matched to known workload, and do not build a contractual dependency on a vendor that has not named itself.
Related reviews
Cloudbypass facts reflect the vendor's own published pricing, FAQ, documentation and refund pages at time of writing (verified via cloudbypass.com and docs.cloudbypass.com). Performance figures such as the 95%+ bypass rate, 1,200+ teams, 90M+ rotating IPs, 99% IP uptime and sub-200ms latency are self-reported by the vendor and have not been independently verified by PROXIES.SX; no methodology, sample or third-party audit is published. No legal entity, SLA document, status page or founding date is published, and those gaps are marked as such rather than inferred. Cloudbypass's own terms state the service is "for research purposes only" and cap liability at the fees paid in the previous month; its refund agreement states that Stripe/Alipay and virtual-currency purchases cannot be refunded in any form. Bypassing WAF, CAPTCHA and anti-bot protections may breach the terms of service of the sites you target and may be restricted in your jurisdiction - readers are responsible for their own legal and contractual compliance. Outbound links to cloudbypass.com and t.me/cloudbypasscom use rel="nofollow sponsored noopener noreferrer".