Sticky sessions on residential proxies: how they work and when to use them

A residential proxy gives you a real household address as your exit. The question this guide answers is how long you keep it. With a rotating session the answer is one request. With a sticky session the answer is as long as you ask for, up to a day. Getting this wrong is an easy way to make a residential plan seem not to work. Every limit and price below is read from the same code that builds your connection strings.

Rotating and sticky, in one paragraph each

Rotating means the network picks an exit for each request and forgets it. Two requests in a row through the same credentials can leave from two different homes in two different cities. Nothing ties them together on the far side. This is the default on GhostConnect: the plain username and password with nothing appended give a new address from any country on every request.

Sticky means you name a session, and the network routes every request that carries that name through the same exit for a fixed lifetime. The site you reach sees one visitor with one address for the whole conversation. When the lifetime ends, the next request with that name gets a new exit, and the name is just a name again.

Both are the same product on the same plan. Bandwidth is billed per gigabyte at $2.99, never expires, and the price does not depend on which kind of session carried the bytes. You can buy 1 to 1000 GB at a time and top up the same plan later. There is no separate sticky plan to buy.

Where the session lives: in the password

On GhostConnect the gateway reads targeting and session settings from the password. The username stays as issued. Everything else is appended to the password as tags, each one an underscore, a name, a hyphen and a value:

• _country-US: a two-letter ISO 3166-1 code, written in capitals.
• _state-new.york and _city-brooklyn: a state and a city, lowercase, with spaces replaced by dots. Both require a country.
• _lifetime-10: how many minutes the exit sticks, 1 to 1440. The dashboard defaults to 30.
• _session-k2p9x7vq: the session name. The dashboard and the API generate eight lowercase letters and digits, and a new one on every click or call.

Lifetime and session always go together: a sticky connection string ends in both. Leave both off and the string is rotating, whatever else it carries. So Yxa5WGCUkvP9km_country-US is a rotating session pinned to the United States, and Yxa5WGCUkvP9km_country-US_lifetime-10_session-k2p9x7vq is one address in the United States for ten minutes.

Because the tags are part of the password, you pass the whole thing as the password. Do not split it.

Three example strings

These use the documentation credentials from the API reference, so they will not connect. Yours are on the dashboard page of your residential plan, and every string below is one the string builder there produces. The host is residential.ghostconnect.io; HTTP on port 1080, SOCKS5 on port 1081. A second port of each kind, 1111 and 2222, behaves the same and exists for networks that block the first.

Example 1, rotating, United States only (host:port:user:pass):

residential.ghostconnect.io:1080:rJxYKRe2U:Yxa5WGCUkvP9km_country-US

Every request gets a fresh American exit. Nothing persists between requests.

Example 2, sticky for ten minutes, Brooklyn, New York (host:port:user:pass):

residential.ghostconnect.io:1080:rJxYKRe2U:Yxa5WGCUkvP9km_country-US_state-new.york_city-brooklyn_lifetime-10_session-k2p9x7vq

One household in Brooklyn for ten minutes. The session name k2p9x7vq is what holds it; the lifetime says for how long.

Example 3, sticky for a full day, Germany, over SOCKS5 (URL):

socks5h://rJxYKRe2U:Yxa5WGCUkvP9km_country-DE_lifetime-1440_session-m4v8q2zt@residential.ghostconnect.io:1081

1440 minutes is the ceiling. The socks5h scheme asks curl and most libraries to resolve hostnames through the proxy rather than on your machine, so the name lookup does not leave your machine either.

Many sessions at once

One sticky string is one exit. If you run twenty browser profiles, or a pool of workers that must each look like a different person, you need twenty session names, not one. Do not invent them by hand; generate a list.

On the dashboard, the string builder has a quantity field: ask for up to 100 lines and each sticky line comes back with its own session id. The API does the same on GET /proxies/residential/obcl4126/connection-string with session=sticky and quantity= up to 100; the response carries the first line as connection and all of them as connections. Nothing is stored on our side. A connection string is arithmetic on your credentials, so generate as many as you like and throw them away when the lifetime runs out.

Rotating lines, by contrast, are all identical. One rotating string is already a pool of exits; a hundred copies are a hundred copies of the same string.

When sticky is the right choice

• Logging in. A sign-in that arrives from one address and the next page load from another looks like a stolen session to a site that checks. Hold the exit for the whole visit.
• Carts and checkouts. Add to basket, enter an address, pay: that is three or more requests that must look like one shopper.
• Any multi-step flow. Forms spread across pages, wizards, anything with a server-side session cookie tied to the client address.
• Testing from one place. When you want to see what a site shows a visitor in a specific city and need the pages to agree with each other.

Pick the shortest lifetime that covers the job. A checkout takes minutes, not a day. The exit is a home connection, not a server you control, and a session is not a guarantee that it stays reachable for the whole lifetime.

When rotating is the right choice

• Scraping. Many independent page fetches, where each one standing alone is a feature: no single address accumulates a request count.
• Availability and price checks. One request per product per region, read the answer, move on.
• Verifying how something renders in a country. A single fetch with _country- set is enough.
• Anything stateless. If the server does not need to recognise you on the next request, do not give it the chance.

Targeting by country, state and city

Country is any ISO 3166-1 alpha-2 code. State and city are plain place names, letters, spaces and hyphens only; the builder lowercases them and turns spaces into dots, so New York becomes new.york and Los Angeles becomes los.angeles. A state or a city without a country is refused, because a city name alone is ambiguous. Targeting and sessions combine freely: a sticky session in one city, a rotating session across one country, or a rotating session with no targeting at all.

Narrower targeting means a smaller pool. Ask for the narrowest geography the job needs, not the narrowest you can.

Common mistakes

1. Inventing a session name that the gateway rejects. A session id is 6 to 15 characters, letters, digits and dashes only. Shorter names like test, longer ones, and anything with an underscore make the gateway drop the connection without an error, which looks like sticky sessions not working at all. Generate names, or keep to the rule.
2. Changing the session id and expecting the same exit. The name is the session. A different name is a different session with a different exit, even one second later with the same lifetime. If you want the same address, send the same string.
3. Reusing a session past its lifetime. A ten-minute session holds its exit for ten minutes, not for as long as you keep sending requests. If your flow runs long, set a longer lifetime up front rather than discovering the switch halfway through a checkout.
4. Putting the tags on the username. They go on the password, and only on the password. The gateway rejects tagged usernames with a 407, which looks like wrong credentials. They are not wrong; they are in the wrong field.
5. Splitting the password at the first underscore. The whole string after the colon is the password, underscores included.
6. Writing place names with spaces. The gateway reads new.york, not new york. Use the builder, or replace the spaces yourself.
7. Treating sticky as a guarantee. The exit is a home connection, and the session keeps it for the lifetime you asked for, no longer. Write flows that survive a change, and check the exit when it matters.

Checking which exit you have

Request a page that echoes the caller's address through the proxy, and read it back. With curl:

curl -x http://residential.ghostconnect.io:1080 -U 'rJxYKRe2U:Yxa5WGCUkvP9km_country-US_lifetime-10_session-k2p9x7vq' https://ifconfig.me

Run it twice with the same string and a sticky session returns the same address both times. Run it twice with a rotating string and the two answers differ. Run it with a different session id and you get a different address again, which is the first mistake above, demonstrated. For a geography check, any public service that maps an address to a city will tell you whether _city-brooklyn landed where you asked.

If every request fails rather than returning a surprising address, check which field the tags are in and whether your tool rewrote the password.

Residential bandwidth is $2.99 per GB and never expires, on the order page. The string builder is on your plan's dashboard page once the payment confirms, and the same options are on the API. For how residential compares with ISP, datacenter and rotating IPv6, see which proxy for which job.