API

A small JSON API for the things worth automating: the endpoints your subscription publishes, what you have used against your allowance, and your IP allowlist.

Base URL: https://console-staging.trueproxies.com/api/customer

Getting a key

Open the subscription in the dashboard and use API keys → Create API key. Give it a label describing where it will run, so you can tell your keys apart later.

Keys carry your subscription’s identity. Anyone holding one can read your endpoints and usage and change your allowlist, so treat it like a password: keep it out of version control, and revoke it the moment it might have leaked. Revoking takes effect immediately.

A key cannot buy anything, cancel anything, change your plan, see your invoices or create another key. Key creation lives in the dashboard behind your login, which is what stops a leaked key from replacing itself.

Authenticating

Send the key as a bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://console-staging.trueproxies.com/api/customer/usage

A missing, unknown or revoked key returns 401. Requests are limited to 120 per minute per key; over that you get 429 with a Retry-After header.

Endpoints

`GET /endpoints`

The hosts and ports your subscription is served on — the same list the dashboard shows.

{
  "username": "tp_example",
  "endpoints": [
    {"node_id": "resi-ipv4-1", "host": "resi-ipv4-1.gw.tprx.io",
     "port": 30075, "protocol": "https", "auth_mode": "password"},
    {"node_id": "resi-ipv4-1", "host": "resi-ipv4-1.gw.tprx.io",
     "port": 30077, "protocol": "http", "auth_mode": "password"}
  ]
}

The proxy password is deliberately not returned. It is available in the dashboard, behind your login — an API key that could hand it over would turn one leaked key into full use of your proxies.

`GET /usage`

Traffic used against the subscription’s allowance, with a daily series.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://console-staging.trueproxies.com/api/customer/usage?days=7"

{
  "bytes_used": 1006,
  "bytes_limit": 1073741824,
  "daily": {
    "granularity": "day",
    "timezone": "UTC",
    "series": [{"date": "2026-08-24", "bytes_in": 512, "bytes_out": 494}]
  }
}

days accepts 1–365 and defaults to 30.

`GET /whitelist`

The source addresses authorised to connect without a password.

{"addresses": [{"id": 12, "ip_address": "203.0.113.7/32", "created_at": "2026-08-24T17:00:00Z"}]}

`POST /whitelist`

Authorise an address. Accepts a bare IP or a CIDR.

curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip_address": "203.0.113.7"}' \
  https://console-staging.trueproxies.com/api/customer/whitelist

Returns 201 when the address is new and 200 when it was already there, so retrying is safe. A malformed address returns 400 naming the value.

Adding your first address also switches the subscription to accept allowlisted sources alongside your password, and publishes the extra endpoints that implies — the same thing the dashboard does. See IP Whitelisting.

`DELETE /whitelist/{id}`

Withdraw an address, using the id from GET /whitelist.

curl -X DELETE -H "Authorization: Bearer YOUR_API_KEY" \
  https://console-staging.trueproxies.com/api/customer/whitelist/12

Always returns 200. An id that does not exist, or belongs to someone else, removes nothing and reports the same result — so a retry after a lost response ends the same way.

Removing your last address switches the subscription back to password-only.

Errors

Every error is JSON with an error field.

Status	Meaning
`400`	The request was malformed — the message names what
`401`	Missing, unknown or revoked key
`429`	Over 120 requests per minute; see `Retry-After`
`500`	Something failed on our side