Proxies, from code.
JSON over HTTPS. Everything the dashboard does with proxies, the API does too, paid from your balance. It knows you by a key, exactly like the website, and by nothing else.
https://ghostconnect.io/api/v1/Authentication
Create a key in Settings. It is shown once; we keep only a SHA-256 hash of it. An account can hold 5 keys, each with a label and each revocable on its own, so the key in one script can be killed without touching the others.
Send it on every request as a bearer token. X-Api-Key is accepted as well. Cookies are ignored: being signed in on the website does not authenticate an API call.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account
Replacing your access key in Settings revokes every API key on the account, because anyone who saw the old access key could have created one.
Requests and responses
- Send bodies as JSON with
Content-Type: application/json. Form-encoded bodies also work. - Every response is a JSON object. Success is
{"ok": true, "data": ...}; failure is{"ok": false, "error": {"code", "message"}}with a matching HTTP status. - Money is a string of US dollars, like
"14.95", so it never loses a cent to floating point. A few per-unit prices carry a third decimal. - Times are Unix seconds.
expires_atisnullfor residential bandwidth, which never expires. - Paying requests take the money from your balance at the moment of the call. Add funds on the website with crypto or a card.
Retrying safely
A network can fail after an order went through. To make retries safe, send an Idempotency-Key header on orders, renew and topup: any unique string of 8 to 64 letters, digits, dashes, underscores, colons or dots, one per purchase.
- The first response to a key is kept for 24 hours. Repeating the same request with the same key returns that response, with
Idempotent-Replayed: true, and charges nothing. - The same key with a different request is refused with
422 idempotency_key_reused. - A retry that arrives while the first request is still running gets
409 idempotency_in_progress. - If a request is refused before any money moves (bad input, short balance), its key is released and can be used again for the corrected request.
curl -X POST -H "Authorization: Bearer $GT_KEY" \
-H "Idempotency-Key: order-2026-09-14-0001" \
-H "Content-Type: application/json" \
-d '{"type":"residential","gb":5}' \
https://ghostconnect.io/api/v1/orders
Rate limits
120 requests a minute per key, of which 30 may be paying requests. Unauthenticated catalog calls get 120 a minute per connection. Past a limit the response is 429 rate_limited with a Retry-After header in seconds.
Errors
| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_order | A field is missing or not allowed. The message names it. |
| 400 | invalid_json, invalid_type, invalid_kind, invalid_targeting | The request itself is malformed. |
| 400 | not_renewable, not_toppable, not_supported | That action does not exist for this proxy type. |
| 400 | allowlist_failed, auto_renew_failed, reset_failed | The change was refused; the message says why. |
| 401 | unauthenticated, invalid_key | No key, or a key that does not exist or was revoked. |
| 402 | insufficient_balance | The balance does not cover it. Includes amount_usd and balance_usd. Nothing was charged. |
| 403 | account_suspended | The account is suspended. |
| 404 | not_found | No such endpoint, or no such proxy or invoice on this account. |
| 405 | method_not_allowed | The path exists with another method. |
| 409 | idempotency_in_progress | The first request with this key has not finished. |
| 413 | body_too_large | Bodies are limited to 64 KB. |
| 422 | idempotency_key_reused | This key was used for a different request. |
| 429 | rate_limited | Slow down; see Retry-After. |
| 500 | internal_error | Our fault. After a paying request, check invoices before retrying without an idempotency key. |
| 502 | terminate_failed | The proxy could not be deleted right now. Nothing was removed; try again shortly. |
| 502 | fulfilment_failed | Paid, but it could not be set up. The full amount is already back on the balance; the invoice is included with status credited. |
| 503 | unavailable | A dependency did not answer. Try again shortly. |
What is recorded
The same as the website, which is almost nothing. There is no access log. Keys have no last-used time and no record of where they were used from. Rate-limit counters are named with a keyed hash that changes daily and are deleted within hours. The only API-specific record is the idempotency response described above, deleted after 24 hours. The rest is what any order leaves: the invoice and the proxy.
Endpoints
GET/catalog
Prices, allowed values and current datacenter stock. No key needed.
curl https://ghostconnect.io/api/v1/catalog
{
"ok": true,
"data": {
"currency": "USD",
"pays_from": "balance",
"products": {
"datacenter": { "price_per_ip_per_31_days_usd": "1.79", "days": [7, 14, 31, ...], "stock": { "ipv4": { "us": 120, ... } } },
"residential": { "price_per_gb_usd": "2.99", ... },
"rotating": { ... },
"isp": { "use_cases": { "us": ["pkc", "ticket", ...] }, ... }
}
}
} GET/account
The account this key belongs to and its balance.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account
{
"ok": true,
"data": { "id": 48, "balance_usd": "133.68", "created_at": 1789350000, "api_keys": 1 }
} POST/quote
The exact price of an order, renewal or top-up, without buying it. Takes kind plus the same fields as the matching purchase; renewals and top-ups also take the proxy id.
| Field | Type | Values |
|---|---|---|
| kind | string | datacenter, residential, rotating, isp, renew_datacenter, renew_rotating, renew_isp, topup_residential |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"kind":"isp","country":"us","months":1,"quantity":2}' \
https://ghostconnect.io/api/v1/quote {
"ok": true,
"data": {
"kind": "isp",
"description": "ISP x2, US, 1 month",
"amount_usd": "10.00",
"lines": { "Country": "United States", "Use case": "Social media", "Term": "1 month", "IPs": 2 },
"balance_usd": "133.68",
"balance_covers": true
}
} POST/orders
Buy proxies. Pays from the balance and returns 201 with the invoice and the new proxies, credentials included, in the same response. Send an Idempotency-Key.
| type | Field | Values |
|---|---|---|
| datacenter | country | us, ca, uk, fr, nl, de |
| ip_type optional | ipv4, ipv6, default ipv4 | |
| days | 7, 14, 31, 62, 93, 186, 365 | |
| quantity optional | 1 to 100, default 1. Limited by stock in GET /catalog. | |
| residential | gb | 1 to 1000. Never expires. |
| rotating | country | ca |
| threads | 100 to 5000, in steps of 100 | |
| days | 7, 14, 30, 60, 90 | |
| isp | country | us, uk, de, nl, sg, es, fr |
| use_case optional | Every location is one all-purpose pool, so the only value is aio, the default. | |
| months | 1 to 24 | |
| quantity optional | 1 to 1000, or up to 249 for 12 months or more, and never more than the country's live stock in GET /catalog. Default 1. |
curl -X POST -H "Authorization: Bearer $GT_KEY" \
-H "Idempotency-Key: order-dc-0001" \
-H "Content-Type: application/json" \
-d '{"type":"datacenter","country":"us","ip_type":"ipv4","days":31,"quantity":2}' \
https://ghostconnect.io/api/v1/orders
{
"ok": true,
"data": {
"invoice": {
"id": "d3z0sya3", "type": "proxy_datacenter_create",
"description": "Datacenter IPv4 x2, US, 31 days", "amount_usd": "3.58",
"payment_method": "balance", "status": "completed",
"proxy_type": "datacenter", "proxy_id": "k2m9x4qa",
"created_at": 1789350000, "paid_at": 1789350000, "completed_at": 1789350003
},
"proxies": [
{
"id": "k2m9x4qa", "type": "datacenter", "created_at": 1789350003,
"country": "us", "ip_type": "ipv4", "ip": "203.0.113.121",
"port_http": 10242, "port_socks5": 10243,
"username": "dxq8m2p", "password": "Zk4pQ9wLr2mT7c",
"allowlist": [], "expires_at": 1792028403,
"auto_renew": { "enabled": false, "days": 31 }
},
{ "id": "p7c1v0ne", ... }
],
"balance_usd": "130.10"
}
}
Residential proxies come back with a host, credentials and bandwidth in GB, three decimals: total_gb, used_gb and remaining_gb, plus synced_at, when that figure was last read from the network. Rotating proxies come back with host, port, threads and credentials (HTTP only); the allowlist is optional. ISP orders come back as one object with an ips array.
{
"id": "obcl4126", "type": "residential", "created_at": 1789350000,
"host": "residential.ghostconnect.io", "port_http": 1080, "port_socks5": 1081,
"username": "rJxYKRe2U", "password": "Yxa5WGCUkvP9km",
"bandwidth": { "total_gb": 10, "used_gb": 0.257, "remaining_gb": 9.743 },
"allowlist": [], "expires_at": null, "synced_at": 1789353600
}
A proxy id is the 8-character lowercase id in these responses, the same one the dashboard shows. An id of any other shape is answered with a 404 that says so.
GET/proxies
Every proxy on the account, oldest first, in the same shape as orders returns. Filter with ?type=. GET /proxies/{type}/{id} returns one as {"proxy": ...}; for ISP, the id of any IP in an order returns the whole order.
| Field | Type | Values |
|---|---|---|
| type optional | query | datacenter, residential, rotating, isp |
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies?type=residential"
POST/proxies/{type}/{id}/renew
Add time to a datacenter, rotating or ISP proxy. An ISP renewal covers every IP in the order. Returns the invoice and the updated proxy. Send an Idempotency-Key: a renewal is not undone by retrying, it is repeated.
| Field | Type | Values |
|---|---|---|
| days | int | datacenter: 7, 14, 31, 62, 93, 186, 365. rotating: 7, 14, 30, 60, 90. |
| months | int | isp only: 1 to 24 |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: renew-k2m9x4qa-2026-10" \
-H "Content-Type: application/json" -d '{"days":31}' \
https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/renew POST/proxies/residential/{id}/topup
Add bandwidth to a residential proxy. Returns the invoice and the updated proxy.
| Field | Type | Values |
|---|---|---|
| gb | int | 1 to 1000 |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: topup-0001" \
-H "Content-Type: application/json" -d '{"gb":10}' \
https://ghostconnect.io/api/v1/proxies/residential/obcl4126/topup POST/proxies/{type}/{id}/allowlist
Allow a source address to use a datacenter, residential or rotating proxy without the password. POST /proxies/{type}/{id}/allowlist/remove with the same body removes one. ISP proxies authenticate by username and password only.
| Field | Type | Values |
|---|---|---|
| ip | string | A public IPv4 or IPv6 address. Up to 10 per proxy. |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"ip":"198.51.100.7"}' https://ghostconnect.io/api/v1/proxies/rotating/r4t8b2kd/allowlist POST/proxies/{type}/{id}/auto-renew
Renew automatically from the balance about a day before expiry. For ISP the setting applies to the whole order. On a proxy object auto_renew is an object, {"enabled": false, "days": 31} (months for ISP), not a flag: read enabled, since the object itself is never empty.
| Field | Type | Values |
|---|---|---|
| enabled | bool | true, false |
| period optional | int | What each renewal adds. datacenter: 7, 14, 31, 62, 93, 186, 365 days. rotating: 7, 14, 30, 60, 90 days. isp: 1 to 24 months. Required when enabling; when disabling it may be left out and the current period is kept. |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"enabled":true,"period":31}' https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/auto-renew POST/proxies/{type}/{id}/reset-credentials
Issue a new username and password for a datacenter, residential or rotating proxy. The old ones stop working at once. No body.
curl -X POST -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/reset-credentials
POST/proxies/{type}/{id}/terminate
Delete a datacenter, residential or rotating proxy for good. It stops working at once, and unused time or bandwidth is not refunded. DELETE /proxies/{type}/{id} does the same. ISP proxies cannot be ended early and return 400 not_supported. If the deletion cannot be confirmed the proxy is kept and you get 502 terminate_failed, so retrying is always safe.
curl -X POST -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/terminate
{
"ok": true,
"data": { "message": "Proxy terminated.", "terminated": { "type": "datacenter", "id": "k2m9x4qa" } }
} POST/proxies/isp/{id}/swap
Replace every IP in an ISP order with new ones. The old IPs stop working at once. Free, once per term; a renewal grants the next. No body. Returns the order with its new ips.
curl -X POST -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/proxies/isp/m4k2v9xa/swap
{
"ok": true,
"data": {
"message": "IPs swapped; the old ones have stopped working. The next free swap comes with the next renewal.",
"proxy": { "id": "m4k2v9xa", "type": "isp", "ips": [ { "ip": "203.0.113.77", ... }, { "ip": "203.0.113.78", ... } ], ... }
}
} GET/proxies/residential/{id}/connection-string
A ready connection with targeting and session appended to the password (that is how the gateway reads them: pass the whole password field as the password). The response carries it as connection (host:port:username:password), as a url, and as its parts. Nothing is stored: generate as many as you need.
| Field | Type | Values |
|---|---|---|
| session optional | query | rotating, sticky, default rotating |
| minutes optional | query | Sticky session length, 1 to 1440, default 30 |
| country optional | query | Any two-letter ISO 3166-1 alpha-2 code, like US or DE |
| state optional | query | State or province, with country. Letters, spaces and hyphens; spaces become dots. |
| city optional | query | City, with country. Same rules as state. |
| protocol optional | query | http, socks5, default http |
| quantity optional | query | 1 to 100 lines, default 1. Sticky lines each get their own session id. |
| format optional | query | colon, url, at, default colon: host:port:user:pass, a URL, or user:pass@host:port. Sets connection and connections. |
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies/residential/obcl4126/connection-string?session=sticky&minutes=10&country=us&state=new%20york&city=brooklyn"
{
"ok": true,
"data": {
"connection": "residential.ghostconnect.io:1080:rJxYKRe2U:Yxa5WGCUkvP9km_country-US_state-new.york_city-brooklyn_lifetime-10_session-k2p9x7vq",
"connections": ["...one line per requested quantity..."],
"format": "host:port:user:pass",
"url": "http://rJxYKRe2U:Yxa5WGCUkvP9km_country-US_state-new.york_city-brooklyn_lifetime-10_session-k2p9x7vq@residential.ghostconnect.io:1080",
"host": "residential.ghostconnect.io", "port": 1080,
"session": "sticky", "protocol": "http", "country": "us", "state": "new.york", "city": "brooklyn", "sticky_minutes": 10
}
} GET/proxies/residential/{id}/usage
Bandwidth used over time, the series the dashboard graphs: hourly for the last 24 hours, per two hours for 7 days, daily for 30 days. Each point is a bucket start in Unix seconds (UTC) and the GB used in it, three decimals. Read live from the network on every call, so bandwidth comes back refreshed too.
| Field | Type | Values |
|---|---|---|
| window optional | query | 24h, 7d, 30d, default 24h |
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies/residential/obcl4126/usage?window=7d"
{
"ok": true,
"data": {
"proxy_id": "obcl4126", "window": "7d", "bucket_hours": 2,
"from": 1788746400, "to": 1789351200,
"points": [
{ "at": 1788746400, "used_gb": 0.012 },
{ "at": 1788753600, "used_gb": 0 },
{ "at": 1788760800, "used_gb": 0.041 },
"...84 points"
],
"total_gb": 0.257, "peak_gb": 0.041,
"bandwidth": { "total_gb": 10, "used_gb": 0.257, "remaining_gb": 9.743 },
"synced_at": 1789351260
}
} GET/invoices
The latest 100 invoices, newest first. GET /invoices/{id} returns one, with the proxies it created. Status is one of completed, credited (paid, not deliverable, refunded to the balance), or a payment state for website payments still in progress.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/invoices
