Proxy API

Everything the dashboard does with residential and mobile proxies, from your own code: proxy lists, sub-users, usage, locations and purchases.

The AeonProxy API is a JSON REST API at https://aeonproxy.com/api/v1. It works with the same account, traffic and logins as the dashboard: a proxy list you generate here works on the gateway at once, a sub-user you create shows up in the dashboard, and traffic you buy is in the same balance.

Every account has an API key, at no extra cost. API calls use no traffic: only the requests you send through the proxies count.

Quickstart

  1. Sign in and copy the key from Settings → API. It starts with ap_live_.
  2. Keep it out of your code: put it in an environment variable.
  3. Call Get the account. A balance in the answer means the key works.
export AEONPROXY_API_KEY="ap_live_…"
curl "https://aeonproxy.com/api/v1/me" -H "Authorization: Bearer $AEONPROXY_API_KEY"

Then generate a proxy list for your tool, or create a sub-user for each project.

Authentication

Send the key in the Authorization header of every request: Authorization: Bearer ap_live_…. Clients that cannot set it can send X-API-Key: ap_live_… instead. Keys never go in the URL.

A request without a valid key gets 401. The key belongs to the account, not to a person: it can do everything below, including buying traffic with the balance, but it cannot open the dashboard, rotate itself or request payouts. Rotating it in Settings → API asks for your password, and the old key stops working at once.

The key is for the API only. Proxy traffic uses your proxy login and password on gate.aeonproxy.com, as described in the gateway documentation.

Requests and answers

Base URL: https://aeonproxy.com/api/v1. Requests with a body send JSON (Content-Type: application/json); answers are JSON, apart from proxy lists you ask for as text. Names are in snake_case.

  • Products are residential and mobile (orders also show isp and datacenter).
  • Traffic is in GB, where 1 GB is 10⁹ bytes, as on your invoices. Money is in US dollars, as a number (balance_usd: 42.5).
  • Times are ISO 8601 in UTC (2026-10-28T09:30:00.000Z).
  • Lists answer { "count", "results" }; long ones page with limit and offset.

Within v1 we only add things: new endpoints, new optional parameters and new fields in answers. Ignore fields your code does not know, and it will keep working.

Errors

A failed request answers with an HTTP status of 400 or above and the same body every time. code is stable and meant for your code; message is written for people and may change; param names the parameter at fault, when there is one.

{
  "error": {
    "code": "invalid_parameter",
    "message": "Unknown country for residential: \"xx\". GET /locations/countries lists them.",
    "param": "country"
  }
}
StatusCodeMeaning
400invalid_parameterA parameter is missing or wrong; param names it
400invalid_jsonThe body is not a JSON object
400invalid_requestAn account rule refused the request (the message says which)
401unauthorizedNo key, or a key that is not valid any more
402insufficient_balanceThe balance does not cover a purchase
403forbiddenThe account email is not confirmed yet
404not_foundNo such endpoint, or no such object on your account
409conflictThe name is taken, or the Idempotency-Key is busy or was used elsewhere
409limit_reachedAn account limit, such as 50 sub-users per product
429rate_limitedToo many requests; wait for Retry-After seconds
500internal_errorOur fault; retry, and tell support if it persists

Errors of the proxy gateway itself (407, 402, 502 on a proxy connection) are listed in the gateway documentation.

Rate limits

Each key can make 120 requests per minute, and 10 of them can be purchases. Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (a Unix time). Over the limit you get 429 with Retry-After in seconds.

The limit is on API calls only: proxy connections through the gateway have no thread limit. If you need a long list of cities or proxies, ask for a bigger page instead of many small ones.

Retries and the Idempotency-Key

Buy traffic and Create a sub-user accept an Idempotency-Key header: any unique string up to 64 characters, such as a UUID. If the connection drops before you get the answer, send the same request with the same key. You get the first answer back (with Idempotent-Replayed: true) instead of a second purchase. Keys are kept for 24 hours. A request that failed can be sent again with the same key.

All endpoints

MethodPathWhat it does
GET/statusCheck the API
GET/meGet the account
GET/credentialsGet proxy credentials
POST/credentials/passwordRotate the proxy password
GET/locations/countriesList countries
GET/locations/regionsList regions
GET/locations/citiesList cities
GET/locations/ispsList ISPs and carriers
POST/proxy-listGenerate a proxy list
GET/proxy-listDownload a proxy list
GET/sub-usersList sub-users
POST/sub-usersCreate a sub-user
GET/sub-users/{id}Get a sub-user
PATCH/sub-users/{id}Update a sub-user
DELETE/sub-users/{id}Delete a sub-user
POST/sub-users/{id}/passwordRotate a sub-user password
GET/usageGet usage
GET/ordersList orders
GET/orders/{id}Get an order
GET/traffic/priceGet a price
POST/traffic/purchaseBuy traffic

OpenAPI and Postman

The whole API is described in one OpenAPI 3.1 file, built from the same source as these pages. Import it into Postman, Insomnia or Bruno, generate a client for your language with OpenAPI Generator, or give it to an AI agent as a tool definition. A ready Postman collection has every request with its example; set the apiKey variable to your key.

Questions about the API

Yes. Every account has an API key in Settings → API from the first sign-in, with the same rate limits for everyone. API calls themselves are free and use no traffic.

Generate proxy lists with country, region, city and ISP targeting; create sub-users with their own traffic limits; read traffic and requests by hour or day; list countries, cities and carriers; check prices and buy traffic from the balance. Proxy traffic itself goes through the gateway, not through the API.

In the dashboard, Settings → API. "Rotate key" asks for your password and gives you a new key; the old one stops working at once, so update your scripts first.

No separate one. Reading endpoints, price quotes and proxy lists change nothing and cost nothing, so you can try them on your account. Only Buy traffic spends the balance, and sub-user calls change your logins.

Any HTTP client. The reference has examples in cURL, Python, Node.js, PHP and Go, and the OpenAPI file lets you generate a client for other languages or import the whole API into Postman, Insomnia or an AI agent.

Yes: the key replaces the password for the API. It does not open the dashboard, cannot rotate itself, and cannot request payouts. Anyone with the key can spend the balance on traffic, so keep it in a secret store.

Your API key is already in the dashboard.