IPProxy API

Residential Proxies: Rotating residential proxies route your traffic through real household IPs. Ideal for web scraping, SEO monitoring, social media and any target that blocks datacenter ranges.

Static Residential (ISP) Proxies: Dedicated static residential IPs registered to consumer ISPs. Datacenter-grade speed with residential trust – perfect for account management and long sessions that must keep the same IP.

Datacenter Proxies: Dedicated datacenter IPs with 1 Gbps uplinks and unlimited traffic. The fastest, most affordable option for targets without strict anti-bot protection.

Use rotating residential proxies when the target blocks datacenter ranges: web scraping, SEO monitoring, ad verification, and similar jobs already listed on the residential product page. Add a session id in the gateway username only when the same IP must stick.

Use ISP proxies (static residential) when an account or shop session must keep one dedicated IP registered to a consumer ISP. The catalog variants are Standard ISP, Native ISP, and Premium Carrier ISP. Premium Carrier is not described as mobile or 4G.

Use datacenter proxies for speed-critical or high-volume jobs against targets that do not require residential trust, such as bulk collection and price monitoring on unprotected sites.

Do not use IPProxy when you need an official MCP server, a language SDK, or a CLI binary. None are published. Call the gateway with an ordinary HTTP or SOCKS client instead.

Follow the acceptable-use section of the Terms of Service before automating traffic. This guide does not grant permission the terms withhold.

Connect through gw.ipproxy.co. Use the port printed on the credential line in the dashboard. Customers commonly see 5001 or 7777. The same port accepts HTTP(S) CONNECT and SOCKS5. Do not substitute a supplier hostname.

Authentication is username and password, issued after a paid order is fulfilled. Placeholders below are not live credentials.

Residential targeting is encoded in the username: -cty-US for a country, -st- and -ct- for state and city where the gateway accepts them, -ss-SESSION-tm-10m for a sticky session. Do not send cty-ALL; omit the country segment for worldwide. For China (CN), do not send an -st- segment. The quick-start guides and help center document these rules.

Copy the host, port, username, and password from the dashboard. Generating lines in the dashboard is the supported way to build sticky usernames.

Proxy traffic authenticates with the gateway username and password on gw.ipproxy.co. That is HTTP proxy authentication, not an OAuth 2.0 bearer token, and it has no scopes.

Dashboard JSON routes such as /api/me authorize the signed-in Supabase session cookie and then read only that account. The check is owner identity, not a named OAuth scope.

Google sign-in is Supabase Auth signInWithOAuth with provider google. The browser returns to /api/callback, which exchanges the code for a website session. That is a login identity provider, not an authorization server for third-party API clients.

On 2026-11-08, https://auth.ipproxy.co/.well-known/openid-configuration returned HTTP 401 with www-authenticate Basic, and https://auth.ipproxy.co/.well-known/oauth-authorization-server returned HTTP 404 with x-sb-error-code feature_disabled.

This repository has no OAuth client registry, token signing key, consent screen, or per-route scope check. Publishing authorize, token, or JWKS URLs here would describe endpoints that do not exist.

Named OAuth scopes are not published because none are enforced. The remaining work is a product and credential blocker, not a missing documentation link:

A product decision that third parties may call the account API with OAuth.

An authorization server with client registration, plus the secrets that server needs. Supabase's OAuth authorization-server metadata is feature_disabled on auth.ipproxy.co.

Named scopes mapped to existing owner-only operations, and enforcement of those scopes in the route handlers. Descriptive role names are not a substitute.

Create an account at /login?mode=signup with Google. The signup screen says no credit card is required to create the account. That step does not issue proxy traffic or an API key.

Open Billing and add USD wallet funds with FastPay. Balance is credited when the payment webhook confirms the top-up. A new account starts without a funded balance.

Buy residential gigabytes or a static IP at checkout. The server recomputes the price. Read the checkout total before paying. There is no complimentary traffic allotment and no hosted sandbox password on ipproxy.co.

After fulfilment, copy the gateway username and password from the dashboard. If fulfilment cannot complete, the quick-start guides state that the charge is refunded to the wallet.

The Proxy Advisor is available after sign-in and does not itself grant proxy traffic. The public latency, traffic-split, and multi-region tools probe a proxy line you already possess.

A supplier sandbox with fake proxies exists only when this application is run by an operator with an empty supplier key. It is not a customer environment on the public site, and this change does not create one.

IPProxy is pay as you go. Residential traffic is sold by the gigabyte and the product copy says that traffic does not expire. Static residential and datacenter IPs are sold for a selected period and can be renewed. Marketing pages say there is no subscription requirement and no contract for standard packages.

The from-price on product cards is the cheapest published volume unit, not a quote for your quantity or country. Native ISP prices vary by country. Checkout is the charge.

Do not call production write APIs (wallet top-up, orders, renewals, cancellation) from an unattended agent. Those routes act on the signed-in account and can spend wallet balance.

Do not put gateway passwords in source control, tickets, or prompts. /api/catalog is a public price list. Other account routes require the website session and are disallowed for crawlers in robots.txt.

Some tool routes return HTTP 429 with error RATE_LIMITED when a single process sees a burst. That is not a published monthly quota.

There is no official MCP server, SDK package, or CLI download on ipproxy.co. Do not invent install commands or repository release assets.

There is no OAuth 2.0 authorization server, token endpoint, JWKS, or scopes_supported list on this domain. Do not send Authorization: Bearer to the gateway or to /api/me and expect an OAuth scope check.

There is no free proxy-traffic plan, trial gigabyte grant, self-serve API key, or public sandbox credential. Account creation only creates the website user.

No postal address or telephone number is published. Do not infer one from infrastructure hostnames.