ProxyKite

Authentication & abilities

Every API call needs a personal API token, sent as a bearer token:

GET /api/v1/proxies HTTP/1.1
Host: proxykite.com
Authorization: Bearer 12|AbCdEf...
Accept: application/json

A missing, wrong, revoked or expired token gets 401 unauthenticated. Tokens are created and revoked in the panel under API tokens; each login can hold up to 50 tokens.

Token abilities (access levels)

Each token has exactly one access level. Levels are cumulative — manage can do everything rotate can, and rotate everything read can.

LevelAllows
readGET everything: account, proxies, usage, SMS, rotation history, whitelist, export, interfaces
rotateread + POST /proxies/{id}/rotate
managerotate + rename, passwords, whitelist changes, auto-rotate, interface settings, node rescan

A call above the token's level answers 403 insufficient_ability. GET /me shows the token's abilities.

Your login still applies

A token never gives more than the login it belongs to:

LoginWhat it can do through the API
Owner of the accounteverything on the account's proxies and nodes
Team adminsame as the owner (not billing or team membership, which the API does not cover)
Team viewerread only — can only create read tokens; any change answers 403 forbidden
Reseller sub-useronly the proxies assigned to it: rotate, auto-rotate, passwords, whitelist, send SMS. Not: rename, limits, SIM, website rules, ports, interfaces, delete/restore, nodes

Proxies or nodes your login cannot see answer 404 not_found — the API never reveals other customers' ids. Visible but not allowed answers 403 forbidden.

A suspended login (or a sub-user / team member of a suspended account) gets 403 account_suspended on every call.

Good practice

  • Give each script its own token with the lowest level it needs (a rotation bot only needs rotate).
  • Set an expiry for tokens you hand to third parties.
  • Changing your panel password does not revoke tokens — revoke them yourself under API tokens if one may have leaked.