Automate sub-user creation, bandwidth allocation, and usage tracking for your own clients. API access is available to approved resellers — request it from API Keys in your dashboard once you're a reseller.
The API is only available to reseller accounts, and only once API access has been approved for that account — plain customer accounts can't use it, since there's nothing for it to automate on a non-reseller account.
Every request needs your API key in the Authorization header, as a bearer token. Keys are prefixed gp_live_ and are only ever shown once, at creation time — GlobProxy doesn't store the plaintext key afterward, only a hash of it, so if you lose it you'll need to revoke and create a new one.
Authorization: Bearer gp_live_xxxxxxxxxxxxxxxxxxxxxxxx
A request with a missing, malformed, revoked, or otherwise invalid key gets a plain 401 — the response body doesn't distinguish between "no such key" and "key revoked" so a leaked key can't be used to probe your account's key history. Keys carry the permissions of the account that created them; there's currently no way to scope a key to a subset of actions.
https://globproxy.com
Errors are JSON with a single error string describing what went wrong. There's no machine-readable error code beyond the HTTP status — match on status first, message second (messages may be reworded over time).
| Field | Type | Description |
|---|---|---|
| 400 | Bad Request | Missing or invalid parameters — see the error message for which one. |
| 401 | Unauthorized | Missing, malformed, or revoked API key. |
| 402 | Payment Required | Not enough bandwidth in your account for the request (sub-user creation). |
| 403 | Forbidden | Account suspended, or API access not enabled on this account. |
| 404 | Not Found | The resource doesn't exist, or doesn't belong to your account. |
| 409 | Conflict | The sub-user is still being provisioned — try again shortly (whitelist endpoints only). |
| 500 | Internal Server Error | Something went wrong on our end — safe to retry once; open a support ticket if it persists. |
There's no hard rate limit on the v1 endpoints today. Treat your key like a password regardless — never expose it in client-side JavaScript, a public repo, or a mobile app bundle; proxy calls to it through your own backend if you need to trigger them from a browser or app.
Your account's overall bandwidth balance — not per sub-user, see the usage endpoint below for that.
curl https://globproxy.com/api/v1/account/bandwidth \ -H "Authorization: Bearer YOUR_KEY"
Response
{
"total_gb": 500,
"used_gb": 128.4,
"available_gb": 371.6,
"expires": "never"
}All proxy credentials (sub-users) on your account, newest first.
curl https://globproxy.com/api/v1/sub-users \ -H "Authorization: Bearer YOUR_KEY"
Response
{
"sub_users": [
{
"id": "3f1a...",
"label": "Client A",
"status": "active",
"gb_allocated": 5,
"gb_used": 1.2,
"country": "us",
"state": "california",
"city": null,
"asn": null,
"session_type": "rotating",
"protocol": "http",
"sticky_duration": null,
"host": "proxy.globproxy.com",
"port": 9000,
"geonode_username": "geonode_xxx",
"connection_username": "geonode_xxx-type-residential-country-us-state-california",
"activated_at": "2026-08-01T12:00:00.000Z",
"created_at": "2026-08-01T12:00:00.000Z"
}
]
}Use connection_username (not geonode_username) as the proxy username — it has your targeting baked in. For a sticky session, generate a fresh -session-* suffix per connection rather than reusing this one indefinitely; that logic lives client-side, this endpoint just returns the base credential.
Creates a new proxy credential and reserves the requested bandwidth from your account balance atomically — a burst of concurrent creates can't oversubscribe your balance.
curl -X POST https://globproxy.com/api/v1/sub-users \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{
"label": "Client A",
"gb_allocated": 5,
"country": "us",
"state": "california",
"protocol": "http",
"session_type": "rotating"
}'Body parameters
| Field | Type | Description |
|---|---|---|
| gb_allocated | number | Required. Bandwidth to reserve for this sub-user, must be > 0. |
| label | string | Optional. Your own name for this credential. |
| country | string | 2-letter ISO code (e.g. "us"). Required if state, city, or asn is set. |
| state | string | Lowercase, no spaces/punctuation. Requires country. |
| city | string | Lowercase, no spaces/punctuation. Requires country. state and city can both be set together. |
| asn | string | number | Numeric ASN, e.g. "13868". |
| session_type | string | "rotating" (default) or "sticky". |
| protocol | string | "http" (default) or "socks5". |
| sticky_duration | number | Minutes the sticky session stays on the same peer. Only used when session_type is "sticky". Default 10. |
| endpoint_count | number | Informational — how many endpoints you intend to generate from this credential. Default 1. |
Response — 201 Created
{
"id": "3f1a...",
"label": "Client A",
"status": "active",
"host": "proxy.globproxy.com",
"port": 9000,
"username": "geonode_xxx",
"connection_username": "geonode_xxx-type-residential-country-us-state-california",
"gb_allocated": 5,
"country": "us"
}status can come back "pending" instead of "active" if the upstream provisioning step is briefly unavailable — the credential and bandwidth reservation are still created, it just activates shortly after rather than instantly. Poll the sub-user via the list endpoint if you need to confirm it's live before using it.
Current usage for a single sub-user, synced live from the upstream provider when the credential is active.
curl https://globproxy.com/api/v1/sub-users/SUB_USER_ID/usage \ -H "Authorization: Bearer YOUR_KEY"
Response
{
"id": "3f1a...",
"label": "Client A",
"status": "active",
"protocol": "http",
"session_type": "rotating",
"gb_allocated": 5,
"gb_used": 1.2,
"gb_remaining": 3.8,
"country": "us",
"state": "california",
"city": null,
"host": "proxy.globproxy.com",
"port": 9000,
"username": "geonode_xxx"
}Deletes a sub-user and releases whatever portion of its bandwidth reservation was never used back to your account balance. Already-consumed usage isn't refunded — only the unused remainder.
curl -X DELETE https://globproxy.com/api/v1/sub-users/SUB_USER_ID \ -H "Authorization: Bearer YOUR_KEY"
Response
{ "success": true }A sub-user that a reseller allocated to you (rather than one you created yourself) can't be deleted through the API, same as in the dashboard — 403 if you try.
Adds bandwidth to a sub-user you already have, instead of creating a new one. Reserves the amount from your balance atomically, same guarantee as creation.
curl -X POST https://globproxy.com/api/v1/sub-users/SUB_USER_ID/topup \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{ "gb_amount": 5 }'Body parameters
| Field | Type | Description |
|---|---|---|
| gb_amount | number | Required. GB to add, must be > 0. |
Response
{ "success": true, "gb_allocated": 10 }gb_allocated is the sub-user's new total cap, not the amount just added. 402 if your account balance can't cover the top-up.
Turns automatic top-up on or off for a sub-user — when its remaining bandwidth drops to threshold_gb, amount_gb is added automatically from your balance, checked on the same cycle that syncs usage.
curl -X PATCH https://globproxy.com/api/v1/sub-users/SUB_USER_ID/auto-topup \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{ "enabled": true, "threshold_gb": 1, "amount_gb": 5 }'Body parameters
| Field | Type | Description |
|---|---|---|
| enabled | boolean | Required. Turn auto-topup on or off. |
| threshold_gb | number | Required when enabling. Remaining GB that triggers a top-up. Can be 0. |
| amount_gb | number | Required when enabling. GB added per trigger, must be > 0. |
Send { "enabled": false } to turn it off — threshold_gb/amount_gb aren't required (or stored) in that case.
IP addresses currently allowed to use this sub-user's credentials.
curl https://globproxy.com/api/v1/sub-users/SUB_USER_ID/whitelist \ -H "Authorization: Bearer YOUR_KEY"
Response
{
"ips": [
{ "ip": "203.0.113.4", "description": "Office IP" }
]
}curl -X POST https://globproxy.com/api/v1/sub-users/SUB_USER_ID/whitelist \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{ "ip": "203.0.113.4", "description": "Office IP" }'Body parameters
| Field | Type | Description |
|---|---|---|
| ip | string | Required. A single IPv4 or IPv6 address — no CIDR ranges. |
| description | string | Required. 1–100 characters, e.g. "Office IP". |
Returns the sub-user's full updated whitelist, same shape as the GET above.
curl -X DELETE "https://globproxy.com/api/v1/sub-users/SUB_USER_ID/whitelist?ip=203.0.113.4" \ -H "Authorization: Bearer YOUR_KEY"
ip is a query parameter here, not a body field.
curl -X POST https://globproxy.com/api/v1/sub-users/SUB_USER_ID/whitelist/bulk \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{
"items": [
{ "ip": "203.0.113.4", "description": "Office IP" },
{ "ip": "198.51.100.9", "description": "Home IP" }
]
}'Up to 150 IPs per request. All-or-nothing — the first invalid entry rejects the whole batch.
curl -X DELETE https://globproxy.com/api/v1/sub-users/SUB_USER_ID/whitelist/bulk \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{ "ips": ["203.0.113.4", "198.51.100.9"] }'A POST-shaped body on a DELETE — deliberate, so it can carry an arbitrary-length list rather than being limited to what fits in a query string.
Targeting is encoded directly in connection_username, in a fixed order: type, country, state and/or city, asn, then (sticky sessions only) lifetime and session id.
| Field | Type | Description |
|---|---|---|
| country | 2-letter ISO code, lowercase | Required if state, city, or asn is set. |
| state / city | lowercase, no spaces or punctuation | Both can be set together — they are not mutually exclusive. |
| asn | numeric string | e.g. "13868". |
Invalid values (wrong length, disallowed characters) get rejected with a 400 at creation time rather than silently dropped or passed through.
Ports by protocol / session type
| Field | Type | Description |
|---|---|---|
| http, rotating | 9000 | |
| http, sticky | 10000 | |
| socks5, rotating | 11000 | |
| socks5, sticky | 12000 |
Already have access? Manage your keys from API Keys in your dashboard. Questions not covered here — support@globproxy.com.