Monocle FAQs
General
What is Monocle?
Monocle is a traffic intelligence tool that identifies anonymised traffic such as VPNs, proxies, and datacenter connections, and provides insights into how users are connecting to your application.
Does Monocle block traffic?
No — not by default.
Monocle evaluates traffic and returns a decision (such as Block or Allow).
Your system is responsible for enforcing that decision.
The only exception is supported edge integrations (such as Cloudflare), where Monocle can enforce decisions directly.
What is a Monocle assessment?
A Monocle assessment is an encrypted payload generated for each session.
It contains information about how a user is connecting (e.g. VPN usage, proxy detection, anonymised status).
You can decrypt and evaluate this data in your backend, or perform analysis directly within the platform via the Monocle UI.
Integration
How do I integrate Monocle?
The most common way is by adding a JavaScript snippet to your application.
You can also integrate Monocle using backend or edge-based approaches depending on your setup.
See Integrations for more details.
Do I need a backend to use Monocle?
No.
You can use Monocle to gain visibility into traffic intelligence via the Monocle UI without acting on it. Optionally, if using a supported integration (Cloudflare), traffic can be enforced (Blocked or Allowed) directly from the UI based on policy configuration.
A backend is only required if you want to:
- Decrypt assessments
- Apply custom enforcement logic
How long does it take to see data?
Typically within minutes of integrating Monocle.
In some cases, it may take up to an hour for data to appear in the dashboard.
Policies & Enforcement
What is the difference between using Monocle to monitor vs enforce traffic decisions?
- Monitor – Monocle can be used to gain visibility into how users connect to your application. This is passive, without impacting users or taking any blocking action
- Enforce – When ready, Monocle can be configured to apply actions such as blocking or allowing traffic based on Monocle's assessments
Most users start with a monitoring phase, before moving on to configuring and enabling enforcement.
What is the difference between Raw Assessment and Policy API?
- Raw Assessment – You decrypt and evaluate traffic yourself (full control)
- Policy API – Monocle evaluates traffic and returns a decision (simpler)
Which policy strategy should I use?
- Allow All – Allow all traffic. No blocking rules are applied.
- Normal – Recommended for most use cases
- Aggressive – Blocks all anonymised traffic (higher risk of false positives)
- Custom (Pro) – Access to all standard options, plus more granular assessment attribute level configuration
Can I block specific services or countries?
Yes.
With a Team plan, you can:
- Block or allow specific Services (e.g. VPN providers)
- Block or allow specific Countries using country codes
Where does enforcement actually happen?
In most setups, enforcement happens in your own infrastructure, such as:
- Backend logic
- API gateways
- Middleware
For Cloudflare integrations, enforcement can happen at the edge and is directly configurable via the Monocle UI.
Troubleshooting
Why am I not seeing any data?
Check that:
- Your Monocle script is correctly installed
- Your publishable key is valid
- Traffic is reaching your application
Why am I seeing "Failed to load Monocle script"?
This usually means the browser or network is blocking Monocle from loading.
Monocle loads from mcl.io, so please ensure this domain is allowed by your browser, firewall, DNS filtering, or endpoint security tools.
You can also test in an incognito window or from another network to confirm whether local filtering is the cause.
Why is traffic not being blocked?
Monocle does not block traffic by default.
Make sure you have:
- Implemented enforcement in your system, or
- Configured a supported integration such as Cloudflare
Why is my traffic marked as a VPN or proxy?
Monocle identifies traffic based on known infrastructure, behaviour, and network signals.
In some cases, shared networks or ISP routing may appear similar to anonymised traffic.
Need Help?
Can't find what you're looking for?