Proxy API
Everything the dashboard does with residential and mobile proxies, from your own code: proxy lists, sub-users, usage, locations and purchases.
The AeonProxy API is a JSON REST API at https://aeonproxy.com/api/v1. It works with the same account, traffic and logins as the dashboard: a proxy list you generate here works on the gateway at once, a sub-user you create shows up in the dashboard, and traffic you buy is in the same balance.
Every account has an API key, at no extra cost. API calls use no traffic: only the requests you send through the proxies count.
Quickstart
- Sign in and copy the key from Settings → API. It starts with
ap_live_. - Keep it out of your code: put it in an environment variable.
- Call Get the account. A balance in the answer means the key works.
export AEONPROXY_API_KEY="ap_live_…"
curl "https://aeonproxy.com/api/v1/me" -H "Authorization: Bearer $AEONPROXY_API_KEY"Then generate a proxy list for your tool, or create a sub-user for each project.
Authentication
Send the key in the Authorization header of every request: Authorization: Bearer ap_live_…. Clients that cannot set it can send X-API-Key: ap_live_… instead. Keys never go in the URL.
A request without a valid key gets 401. The key belongs to the account, not to a person: it can do everything below, including buying traffic with the balance, but it cannot open the dashboard, rotate itself or request payouts. Rotating it in Settings → API asks for your password, and the old key stops working at once.
The key is for the API only. Proxy traffic uses your proxy login and password on gate.aeonproxy.com, as described in the gateway documentation.
Requests and answers
Base URL: https://aeonproxy.com/api/v1. Requests with a body send JSON (Content-Type: application/json); answers are JSON, apart from proxy lists you ask for as text. Names are in snake_case.
- Products are
residentialandmobile(orders also showispanddatacenter). - Traffic is in GB, where 1 GB is 10⁹ bytes, as on your invoices. Money is in US dollars, as a number (
balance_usd: 42.5). - Times are ISO 8601 in UTC (
2026-10-28T09:30:00.000Z). - Lists answer
{ "count", "results" }; long ones page withlimitandoffset.
Within v1 we only add things: new endpoints, new optional parameters and new fields in answers. Ignore fields your code does not know, and it will keep working.
Errors
A failed request answers with an HTTP status of 400 or above and the same body every time. code is stable and meant for your code; message is written for people and may change; param names the parameter at fault, when there is one.
{
"error": {
"code": "invalid_parameter",
"message": "Unknown country for residential: \"xx\". GET /locations/countries lists them.",
"param": "country"
}
}| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_parameter | A parameter is missing or wrong; param names it |
| 400 | invalid_json | The body is not a JSON object |
| 400 | invalid_request | An account rule refused the request (the message says which) |
| 401 | unauthorized | No key, or a key that is not valid any more |
| 402 | insufficient_balance | The balance does not cover a purchase |
| 403 | forbidden | The account email is not confirmed yet |
| 404 | not_found | No such endpoint, or no such object on your account |
| 409 | conflict | The name is taken, or the Idempotency-Key is busy or was used elsewhere |
| 409 | limit_reached | An account limit, such as 50 sub-users per product |
| 429 | rate_limited | Too many requests; wait for Retry-After seconds |
| 500 | internal_error | Our fault; retry, and tell support if it persists |
Errors of the proxy gateway itself (407, 402, 502 on a proxy connection) are listed in the gateway documentation.
Rate limits
Each key can make 120 requests per minute, and 10 of them can be purchases. Every answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (a Unix time). Over the limit you get 429 with Retry-After in seconds.
The limit is on API calls only: proxy connections through the gateway have no thread limit. If you need a long list of cities or proxies, ask for a bigger page instead of many small ones.
Retries and the Idempotency-Key
Buy traffic and Create a sub-user accept an Idempotency-Key header: any unique string up to 64 characters, such as a UUID. If the connection drops before you get the answer, send the same request with the same key. You get the first answer back (with Idempotent-Replayed: true) instead of a second purchase. Keys are kept for 24 hours. A request that failed can be sent again with the same key.
All endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /status | Check the API |
| GET | /me | Get the account |
| GET | /credentials | Get proxy credentials |
| POST | /credentials/password | Rotate the proxy password |
| GET | /locations/countries | List countries |
| GET | /locations/regions | List regions |
| GET | /locations/cities | List cities |
| GET | /locations/isps | List ISPs and carriers |
| POST | /proxy-list | Generate a proxy list |
| GET | /proxy-list | Download a proxy list |
| GET | /sub-users | List sub-users |
| POST | /sub-users | Create a sub-user |
| GET | /sub-users/{id} | Get a sub-user |
| PATCH | /sub-users/{id} | Update a sub-user |
| DELETE | /sub-users/{id} | Delete a sub-user |
| POST | /sub-users/{id}/password | Rotate a sub-user password |
| GET | /usage | Get usage |
| GET | /orders | List orders |
| GET | /orders/{id} | Get an order |
| GET | /traffic/price | Get a price |
| POST | /traffic/purchase | Buy traffic |
OpenAPI and Postman
The whole API is described in one OpenAPI 3.1 file, built from the same source as these pages. Import it into Postman, Insomnia or Bruno, generate a client for your language with OpenAPI Generator, or give it to an AI agent as a tool definition. A ready Postman collection has every request with its example; set the apiKey variable to your key.
Questions about the API
Yes. Every account has an API key in Settings → API from the first sign-in, with the same rate limits for everyone. API calls themselves are free and use no traffic.
Generate proxy lists with country, region, city and ISP targeting; create sub-users with their own traffic limits; read traffic and requests by hour or day; list countries, cities and carriers; check prices and buy traffic from the balance. Proxy traffic itself goes through the gateway, not through the API.
In the dashboard, Settings → API. "Rotate key" asks for your password and gives you a new key; the old one stops working at once, so update your scripts first.
No separate one. Reading endpoints, price quotes and proxy lists change nothing and cost nothing, so you can try them on your account. Only Buy traffic spends the balance, and sub-user calls change your logins.
Any HTTP client. The reference has examples in cURL, Python, Node.js, PHP and Go, and the OpenAPI file lets you generate a client for other languages or import the whole API into Postman, Insomnia or an AI agent.
Yes: the key replaces the password for the API. It does not open the dashboard, cannot rotate itself, and cannot request payouts. Anyone with the key can spend the balance on traffic, so keep it in a secret store.