{"openapi":"3.1.0","info":{"title":"IPProxy API","version":"documented-surface","summary":"Proxy gateway plus a small public catalog. Not an OAuth 2.0 API.","description":"IPProxy (ipproxy.co) provides rotating residential proxies, static residential ISP proxies, and datacenter proxies over HTTP(S) and SOCKS5, billed from a prepaid USD wallet.\n\nThe customer integration is HTTP proxy authentication on gw.ipproxy.co, not a bearer token.\nWebsite account routes use the Supabase session cookie of the signed-in user.\n\nOAuth 2.0 is not implemented:\n- Proxy traffic authenticates with the gateway username and password on gw.ipproxy.co. That is HTTP proxy authentication, not an OAuth 2.0 bearer token, and it has no scopes.\n- Dashboard JSON routes such as /api/me authorize the signed-in Supabase session cookie and then read only that account. The check is owner identity, not a named OAuth scope.\n- Google sign-in is Supabase Auth signInWithOAuth with provider google. The browser returns to /api/callback, which exchanges the code for a website session. That is a login identity provider, not an authorization server for third-party API clients.\n- On 2026-11-08, https://auth.ipproxy.co/.well-known/openid-configuration returned HTTP 401 with www-authenticate Basic, and https://auth.ipproxy.co/.well-known/oauth-authorization-server returned HTTP 404 with x-sb-error-code feature_disabled.\n- This repository has no OAuth client registry, token signing key, consent screen, or per-route scope check. Publishing authorize, token, or JWKS URLs here would describe endpoints that do not exist.\n\nBlocked until a product decision and authorization-server credentials exist:\n- A product decision that third parties may call the account API with OAuth.\n- An authorization server with client registration, plus the secrets that server needs. Supabase's OAuth authorization-server metadata is feature_disabled on auth.ipproxy.co.\n- Named scopes mapped to existing owner-only operations, and enforcement of those scopes in the route handlers. Descriptive role names are not a substitute.\n\nPublished contacts: support@ipproxy.co (customer support); sales@ipproxy.co (sales); contact@ipproxy.co (customer service).\nNo postal address or telephone is published."},"servers":[{"url":"https://ipproxy.co"}],"paths":{"/api/catalog":{"get":{"operationId":"getCatalog","summary":"Public product catalog and runtime flags","description":"Unauthenticated. Returns selling information for the storefront. The server recomputes order totals at checkout. sandbox and demoLoginEnabled describe this deployment; they do not mean the public site issues sandbox credentials.","security":[],"responses":{"200":{"description":"Catalog payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Catalog"}}}}}}},"/api/locations":{"get":{"operationId":"getLocations","summary":"Location list for a product","description":"Unauthenticated lookup used by checkout. level=state or level=city requires a two-letter country code.","security":[],"parameters":[{"name":"sku","in":"query","schema":{"type":"string","examples":["residential"]}},{"name":"level","in":"query","schema":{"type":"string","enum":["country","state","city"]}},{"name":"country","in":"query","schema":{"type":"string"}},{"name":"variant","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"Location items","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Locations"}}}},"400":{"description":"Unknown product or missing country","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/me":{"get":{"operationId":"getMe","summary":"Signed-in account summary","description":"Requires the website session cookie. Returns only the signed-in user and that user's wallet balance. There is no scope parameter.","security":[{"websiteSession":[]}],"responses":{"200":{"description":"Account summary","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Me"}}}},"401":{"description":"No session","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}},"components":{"securitySchemes":{"websiteSession":{"type":"apiKey","in":"cookie","name":"sb-*-auth-token","description":"Supabase SSR session cookie (name starts with sb- and ends with -auth-token) created by Google sign-in. It identifies the account owner. It is not an OAuth 2.0 access token, has no scopes, and is not minted for third-party clients."},"proxyGatewayPassword":{"type":"http","scheme":"basic","description":"HTTP proxy username and password for gw.ipproxy.co only. Not accepted as authorization for the REST paths in this document. Issued after a paid order. No scopes."}},"schemas":{"Catalog":{"type":"object","required":["products"],"properties":{"sandbox":{"type":"boolean"},"demoLoginEnabled":{"type":"boolean"},"products":{"type":"array","items":{"$ref":"#/components/schemas/Product"}}}},"Product":{"type":"object","required":["sku","name"],"properties":{"sku":{"type":"string"},"kind":{"type":"string"},"name":{"type":"string"},"unit":{"type":"string"},"fromPriceCents":{"type":"integer"}},"additionalProperties":true},"Locations":{"type":"object","properties":{"items":{"type":"array"},"cached":{"type":"boolean"}}},"Me":{"type":"object","properties":{"user":{"type":"object"},"balanceCents":{"type":"integer"},"advisorCompleted":{"type":"boolean"}}},"Error":{"type":"object","properties":{"error":{"type":"string"},"message":{"type":"string"}}}}}}