#Getting started

The ProxyKite API lets your own scripts do what you do in the panel: list your proxies, rotate their IPs, change passwords and whitelists, and read usage, SMS and rotation history.

#1. Create an API token

1. Sign in to the panel at proxykite.com.
2. Open API tokens in the left menu.
3. Give the token a name (for example my-scraper), pick its access level — read, rotate or manage (see Authentication & abilities) — and optionally an expiry in days.
4. Click Create and copy the token now. It is shown only once. It looks like 12|AbCdEf….

Store it in an environment variable rather than in your code:

export HYP_TOKEN='12|AbCdEf...'

Revoke a token at any time on the same page; it stops working immediately.

#2. Base URL and headers

Successful responses wrap their payload in a data key:

{"data": {"id": 7, "label": "Shop A", "port": 30007, "...": "..."}}

The one exception is POST /proxies/{id}/rotate, which answers with a flat {"ok": true, "old_ip": "…", "new_ip": "…"} object.

#3. Your first request

Check that the token works with GET /me. Every endpoint page has the same example in four languages: curl, Python (requests), Node.js (18+, built-in fetch; save as .mjs for top-level await) and PHP (curl extension). All of them read the token from the HYP_TOKEN environment variable.

curl 'https://proxykite.com/api/v1/me' \
  -H "Authorization: Bearer $HYP_TOKEN" \
  -H 'Accept: application/json'

import os
import requests

r = requests.get(
    "https://proxykite.com/api/v1/me",
    headers={"Authorization": f"Bearer {os.environ['HYP_TOKEN']}", "Accept": "application/json"},
    timeout=30,
)
print(r.status_code, r.json())

const res = await fetch('https://proxykite.com/api/v1/me', {
  headers: {
    Authorization: `Bearer ${process.env.HYP_TOKEN}`,
    Accept: 'application/json',
  },
  signal: AbortSignal.timeout(30000),
});
console.log(res.status, await res.json());

<?php
$ch = curl_init('https://proxykite.com/api/v1/me');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('HYP_TOKEN'),
        'Accept: application/json',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
var_dump($status, json_decode($body, true));

Then list your proxies with GET /proxies and rotate one with POST /proxies/{id}/rotate.

#Rate limits

• 120 requests per minute per login across all of that login's tokens. Over the limit you get 429 rate_limited with a Retry-After header (seconds).
• Rotation links (/r/{token}, no API token) have their own limits: 6 per minute per link and 30 per minute per client IP.
• A rotation takes up to about 60 seconds; a second rotation of the same proxy while one is running answers 409 rotation_in_progress.

#Errors

Every error is JSON with a machine-readable error code and a human message, and the HTTP status matches:

{"error": "insufficient_ability", "message": "This API token lacks the 'manage' ability."}

Validation errors (422) also list the bad fields:

{"error": "validation_failed", "message": "Range too wide: the smallest allowed prefix is /16.",
 "fields": {"cidr": ["Range too wide: the smallest allowed prefix is /16."]}}

The full list of codes is on Errors & rate limits.