API key and security
Settings → API holds the key for the REST API. Settings → Security holds the password, the second sign-in step and the devices signed in to your account.
- API key
- Settings → API
- Password, two-factor, sessions
- Settings → Security
- Second factor
- 6-digit codes from our Telegram bot
- Sessions
- End after 30 days, or after 14 days without activity
Your API key
Every account has one key from the first sign-in, at no extra cost. It starts with ap_live_. The field hides it: the eye button shows it and the copy button next to it copies it. Under the field you see when the key was created and when it was last used.
Send the key as Authorization: Bearer <key> or in an X-API-Key header to https://aeonproxy.com/api/v1; the API reference has examples in cURL, Python, Node.js, PHP, Go, Java and C#. The key reaches everything the API does: proxy lists, sub-users, usage, orders, invoices and traffic purchases from the balance. It does not open the dashboard, cannot rotate itself and cannot request payouts. Keep it in an environment variable or a secret store, never in code you share.
Rotate the key
- Open Settings → API and press Rotate key.
- Enter your account password and press Rotate key in the dialog.
- The new key appears at once and the old one stops working immediately. Update your scripts.
Signed up with Google and never set a password? Set one with Forgot password? on the login page first: rotating the key, changing the password and crypto payouts all ask for it.
Change the password
In Settings → Security → Password, fill in Current password, New password and Confirm password, then press Update password. The new one needs 8 or more characters, an uppercase letter and a number. Every other device is signed out. Your proxy password is separate: change it with Regenerate password on the Residential or Mobile page, or through the API.
Two-factor sign-in
Telegram codes add a second step: after the password, our bot sends a 6-digit code that you enter to finish signing in. The code expires in 10 minutes. It needs Telegram linked on the Profile tab (Link Telegram, then Start in the bot); once linked it is on by default, and the switch turns it off or back on. Authenticator app (TOTP) is listed on the tab but is not available yet.
Sessions and sign-in alerts
Sessions lists the browsers signed in to your account, with IP and last activity. Revoke ends one; your current session ends with Log out in the account menu. A session lasts 30 days if you ticked Keep me signed in for 30 days at login, one day if not, and ends earlier after 14 days without activity.
A sign-in from a new device or network sends a “New sign-in” notification and an email, and a Telegram message if the bot is linked. Not you? Revoke that session and change your password.
Questions
No. The key is for the REST API; proxies use the login and password from the Residential and Mobile pages. Changing one does not change the other.
Yes, the key is enough for the API. Remember that it can spend the balance on traffic, and rotate it when someone leaves the project.
No. It works until you rotate it. Requests are limited per key per minute; the limits are in the API reference.