B.Y.P.A.S.S

Authentication Header

Include your API Key in the c-api-key header in all your requests. This key is provided by B.Y.P.A.S.S upon service registration.

c-api-key: {apikey}

Detailed Description

This parameter defines the final destination of the protected link. When a user successfully completes all required verifications and monetization tasks, they will be automatically redirected to this URL.

• Must be a valid URL with protocol (http:// or https://)
• Can contain query string parameters
• Supports any valid domain
• HTTPS is recommended for greater security

Tokens by Provider

Depending on the selected provider, the pikey value must correspond to one of the following credential types:

Available Providers

Automatic Domain Routing

The previous tier-based domain assignment has been replaced with intelligent auto-routing. The system automatically distributes users across all available domains (kys.linkvertise.lol, red-square.space, and rs.linkvertise.lol) to optimize performance, ensure high availability, and prevent any single domain from becoming a bottleneck.

Detailed Description

This parameter allows loading custom advertisement scripts on the task completion page, enabling additional monetization opportunities.

How Does It Work?

When this option is enabled, the system verifies the Referer header of each incoming request. If the request originates from a known bypass service domain (such as websites offering to skip monetization), access will be automatically denied.

Allowed Values

The value must be a numeric string between "1" and "5". Higher task numbers increase monetization but also the time required from users.

Allowed Values (1–4)

Matches LootLabs: which ads the visitor sees on the locker.

Detectable Services

Detailed Description

This configuration helps detect automated bypasses that attempt to complete the process instantly. If a user "completes" the adlink in less than the specified time, they will be marked as suspicious and denied access.

What are Userscripts?

Userscripts are small JavaScript programs that users can install in their browsers to modify website behavior. Some of these scripts are specifically designed to skip link monetization.

Available Options

How It Works

Task Object Structure

Complete Examples

"XTra_tasks": [
  {
    "Title": "Subscribe to our YouTube Channel",
    "Descr": "Get exclusive content and updates",
    "link": "https://youtube.com/@myawesomechannel",
    "ID": "youtube_sub_unique_2024"
  },
  {
    "Title": "Join our Discord Community",
    "Descr": "Connect with thousands of members",
    "link": "https://discord.gg/abcd1234",
    "ID": "discord_join_2024"
  },
  {
    "Title": "Follow on Twitter",
    "Descr": "Stay updated with the latest news",
    "link": "https://twitter.com/myhandle",
    "ID": "twitter_follow_unique_001"
  }
]

Detection Technique

Some advanced userscripts attempt to conceal their presence by modifying URL parameters in subtle ways, including the use of Unicode characters that look identical to normal ASCII characters but have different codes.

This function verifies URL parameter integrity to detect if they have been modified by a userscript, blocking access if alterations are detected.

How Does the Honeypot Work?

This is one of B.Y.P.A.S.S's most effective techniques. Instead of simply blocking bypass attempts, the system simulates a successful response that userscripts interpret as a completed bypass.

How Does It Work?

When this option is enabled, the system removes the Red-Square advertising layer and provides direct links to the original creator's adlinks. This significantly improves the end user experience by eliminating unnecessary intermediaries.

Quick Explain: How It Works

To stop users from copying the ad-link and dropping it into a bypass site, we run it inside our own isolated VM, under our own domain. The link itself is randomized so it cannot just be copied and reused elsewhere.

The ad-link is then loaded inside a realm. Top-level userscripts (F.E.A.R by MCB, Evade by Skipped.lol) are built specifically to avoid running inside realms like this one, since realms are easy to fingerprint. This step alone kills about 99% of bypass attempts. Only advanced users make it past this point.

Next, we run 2 to 5 decoy realms alongside the real one, so a script has no way of knowing which realm holds the actual destination. Inject into the wrong one and it gets flagged and blocked. Inject into the right one and it still gets caught.

Finally, every realm is checked every 5 seconds for anomalies, and the results are sent to our servers over YX, an encrypted client-server channel that isn't readable even by the client itself. This is what gets us to a 100% detection rate.

Set to false to skip the isolated VM stage entirely for this link. Defaults to true when omitted.

VMode Tiers

Set VMode to one of three presets. Strictness is per provider, since each one handles VM entry differently.

Defaults to "medium" when omitted. Higher tiers mean more friction (and more monetized completions) before a user reaches the VM; "onlyvm" skips straight to the isolated VM with no extra checks and no decoys. Ignored when "enabled": false.

How Does It Work?

When this setting is enabled and a bypass attempt is detected, the system will not block the user. Instead, it appends a RS_EvaluationDT query parameter to the final destination URL. This token is valid for 30 seconds and can be verified server-side by making a GET request to the /api/v2/ManualReport endpoint.

Flow Overview

1. User completes the monetization link
2. B.Y.P.A.S.S detects a bypass attempt
3. Instead of blocking, the user is redirected to the destination URL with ?RS_EvaluationDT=<token> appended
4. Your server receives the request, extracts the token, and sends a GET to /api/v2/ManualReport?tk=<token>
5. The API returns a FinalReport with what was detected, you decide how to proceed