Proxies, from code.
JSON over HTTPS. Everything the dashboard does with proxies, the API does too, paid from your balance. It knows you by a key, exactly like the website, and by nothing else.
https://ghostconnect.io/api/v1/Authentication
Create a key in Settings. It is shown once; we keep only a SHA-256 hash of it. An account can hold 5 keys, each with a label and each revocable on its own, so the key in one script can be killed without touching the others.
Send it on every request as a bearer token. X-Api-Key is accepted as well. Cookies are ignored: being signed in on the website does not authenticate an API call.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account
Replacing your access key in Settings revokes every API key on the account, because anyone who saw the old access key could have created one.
Requests and responses
- Send bodies as JSON with
Content-Type: application/json. Form-encoded bodies also work. - Every response is a JSON object. Success is
{"ok": true, "data": ...}; failure is{"ok": false, "error": {"code", "message"}}with a matching HTTP status. - Money is a string of US dollars, like
"14.95", so it never loses a cent to floating point. A few per-unit prices carry a third decimal. - Times are Unix seconds.
expires_atisnullfor residential bandwidth, which never expires. - Paying requests take the money from your balance at the moment of the call. Add funds on the website with crypto or a card.
Retrying safely
A network can fail after an order went through. To make retries safe, send an Idempotency-Key header on orders, renew and topup: any unique string of 8 to 64 letters, digits, dashes, underscores, colons or dots, one per purchase.
- The first response to a key is kept for 24 hours. Repeating the same request with the same key returns that response, with
Idempotent-Replayed: true, and charges nothing. - The same key with a different request is refused with
422 idempotency_key_reused. - A retry that arrives while the first request is still running gets
409 idempotency_in_progress. - If a request is refused before any money moves (bad input, short balance), its key is released and can be used again for the corrected request.
curl -X POST -H "Authorization: Bearer $GT_KEY" \
-H "Idempotency-Key: order-2026-09-14-0001" \
-H "Content-Type: application/json" \
-d '{"type":"residential","gb":5}' \
https://ghostconnect.io/api/v1/orders
Rate limits
120 requests a minute per key, of which 30 may be paying requests. Unauthenticated catalog calls get 120 a minute per connection. Past a limit the response is 429 rate_limited with a Retry-After header in seconds.
Errors
| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_order | A field is missing or not allowed. The message names it. |
| 400 | invalid_json, invalid_type, invalid_kind, invalid_country | The request itself is malformed. |
| 400 | not_renewable, not_toppable, not_supported | That action does not exist for this proxy type. |
| 400 | allowlist_failed, auto_renew_failed, reset_failed | The change was refused; the message says why. |
| 401 | unauthenticated, invalid_key | No key, or a key that does not exist or was revoked. |
| 402 | insufficient_balance | The balance does not cover it. Includes amount_usd and balance_usd. Nothing was charged. |
| 403 | account_suspended | The account is suspended. |
| 404 | not_found | No such endpoint, or no such proxy or invoice on this account. |
| 405 | method_not_allowed | The path exists with another method. |
| 409 | idempotency_in_progress | The first request with this key has not finished. |
| 413 | body_too_large | Bodies are limited to 64 KB. |
| 422 | idempotency_key_reused | This key was used for a different request. |
| 429 | rate_limited | Slow down; see Retry-After. |
| 500 | internal_error | Our fault. After a paying request, check invoices before retrying without an idempotency key. |
| 502 | fulfilment_failed | Paid, but it could not be set up. The full amount is already back on the balance; the invoice is included with status credited. |
| 503 | unavailable | A dependency did not answer. Try again shortly. |
What is recorded
The same as the website, which is almost nothing. There is no access log. Keys have no last-used time and no record of where they were used from. Rate-limit counters are named with a keyed hash that changes daily and are deleted within hours. The only API-specific record is the idempotency response described above, deleted after 24 hours. The rest is what any order leaves: the invoice and the proxy.
Endpoints
GET/catalog
Prices, allowed values and current datacenter stock. No key needed.
curl https://ghostconnect.io/api/v1/catalog
{
"ok": true,
"data": {
"currency": "USD",
"pays_from": "balance",
"products": {
"datacenter": { "price_per_ip_per_31_days_usd": "1.79", "days": [7, 14, 31, ...], "stock": { "ipv4": { "us": 120, ... } } },
"residential": { "price_per_gb_usd": "2.99", ... },
"rotating": { ... },
"isp": { "use_cases": { "us": ["pkc", "ticket", ...] }, ... }
}
}
} GET/account
The account this key belongs to and its balance.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/account
{
"ok": true,
"data": { "id": 48, "balance_usd": "133.68", "created_at": 1789350000, "api_keys": 1 }
} POST/quote
The exact price of an order, renewal or top-up, without buying it. Takes kind plus the same fields as the matching purchase; renewals and top-ups also take the proxy id.
| Field | Type | Values |
|---|---|---|
| kind | string | datacenter, residential, rotating, isp, renew_datacenter, renew_rotating, renew_isp, topup_residential |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"kind":"isp","country":"us","use_case":"social","months":1,"quantity":2}' \
https://ghostconnect.io/api/v1/quote {
"ok": true,
"data": {
"kind": "isp",
"description": "ISP x2, US, 1 month",
"amount_usd": "10.00",
"lines": { "Country": "United States", "Use case": "Social media", "Term": "1 month", "IPs": 2 },
"balance_usd": "133.68",
"balance_covers": true
}
} POST/orders
Buy proxies. Pays from the balance and returns 201 with the invoice and the new proxies, credentials included, in the same response. Send an Idempotency-Key.
| type | Field | Values |
|---|---|---|
| datacenter | country | us, ca, uk, fr, nl, de |
| ip_type optional | ipv4, ipv6, default ipv4 | |
| days | 7, 14, 31, 62, 93, 186, 365 | |
| quantity optional | 1 to 100, default 1. Limited by stock in GET /catalog. | |
| residential | gb | 1 to 1000. Never expires. |
| rotating | country | ca |
| threads | 100 to 5000, in steps of 100 | |
| days | 7, 14, 30, 60, 90 | |
| isp | country | us, uk, de, hk, jp, ca, it, fr, pl, es |
| use_case | Depends on the country; see use_cases in GET /catalog. One of pkc, ticket, sneaker, retail, social, ipqs, aio. | |
| months | 1 to 24 | |
| quantity optional | 1 to 1000, or up to 249 for 12 months or more. Default 1. |
curl -X POST -H "Authorization: Bearer $GT_KEY" \
-H "Idempotency-Key: order-dc-0001" \
-H "Content-Type: application/json" \
-d '{"type":"datacenter","country":"us","ip_type":"ipv4","days":31,"quantity":2}' \
https://ghostconnect.io/api/v1/orders
{
"ok": true,
"data": {
"invoice": {
"id": "d3z0sya3", "type": "proxy_datacenter_create",
"description": "Datacenter IPv4 x2, US, 31 days", "amount_usd": "3.58",
"payment_method": "balance", "status": "completed",
"proxy_type": "datacenter", "proxy_id": "k2m9x4qa",
"created_at": 1789350000, "paid_at": 1789350000, "completed_at": 1789350003
},
"proxies": [
{
"id": "k2m9x4qa", "type": "datacenter", "created_at": 1789350003,
"country": "us", "ip_type": "ipv4", "ip": "203.0.113.121",
"port_http": 10242, "port_socks5": 10243,
"username": "dxq8m2p", "password": "Zk4pQ9wLr2mT7c",
"allowlist": [], "expires_at": 1792028403,
"auto_renew": { "enabled": false, "days": 31 }
},
{ "id": "p7c1v0ne", ... }
],
"balance_usd": "130.10"
}
}
Residential proxies come back with a host, credentials and bandwidth in GB. Rotating proxies come back with host, port and threads, and authorise by the allowlist. ISP orders come back as one object with an ips array.
GET/proxies
Every proxy on the account, oldest first, in the same shape as orders returns. Filter with ?type=. GET /proxies/{type}/{id} returns one as {"proxy": ...}; for ISP, the id of any IP in an order returns the whole order.
| Field | Type | Values |
|---|---|---|
| type optional | query | datacenter, residential, rotating, isp |
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies?type=residential"
POST/proxies/{type}/{id}/renew
Add time to a datacenter, rotating or ISP proxy. An ISP renewal covers every IP in the order. Returns the invoice and the updated proxy. Send an Idempotency-Key: a renewal is not undone by retrying, it is repeated.
| Field | Type | Values |
|---|---|---|
| days | int | datacenter: 7, 14, 31, 62, 93, 186, 365. rotating: 7, 14, 30, 60, 90. |
| months | int | isp only: 1 to 24 |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: renew-k2m9x4qa-2026-10" \
-H "Content-Type: application/json" -d '{"days":31}' \
https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/renew POST/proxies/residential/{id}/topup
Add bandwidth to a residential proxy. Returns the invoice and the updated proxy.
| Field | Type | Values |
|---|---|---|
| gb | int | 1 to 1000 |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Idempotency-Key: topup-0001" \
-H "Content-Type: application/json" -d '{"gb":10}' \
https://ghostconnect.io/api/v1/proxies/residential/obcl4126/topup POST/proxies/{type}/{id}/allowlist
Allow a source address to use a datacenter, residential or rotating proxy without the password. POST /proxies/{type}/{id}/allowlist/remove with the same body removes one. ISP proxies authenticate by username and password only.
| Field | Type | Values |
|---|---|---|
| ip | string | A public IPv4 or IPv6 address. Up to 10 per proxy. |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"ip":"198.51.100.7"}' https://ghostconnect.io/api/v1/proxies/rotating/r4t8b2kd/allowlist POST/proxies/{type}/{id}/auto-renew
Renew automatically from the balance about a day before expiry. For ISP the setting applies to the whole order.
| Field | Type | Values |
|---|---|---|
| enabled | bool | true, false |
| period | int | What each renewal adds. datacenter: 7, 14, 31, 62, 93, 186, 365 days. rotating: 7, 14, 30, 60, 90 days. isp: 1 to 24 months. |
curl -X POST -H "Authorization: Bearer $GT_KEY" -H "Content-Type: application/json" \
-d '{"enabled":true,"period":31}' https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/auto-renew POST/proxies/{type}/{id}/reset-credentials
Issue a new username and password for a datacenter, residential or rotating proxy. The old ones stop working at once. No body.
curl -X POST -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/proxies/datacenter/k2m9x4qa/reset-credentials
GET/proxies/residential/{id}/connection-string
A ready host:port:username:password line with targeting and session built in.
| Field | Type | Values |
|---|---|---|
| session optional | query | rotating, sticky, default rotating |
| minutes optional | query | Sticky session length, 1 to 1440, default 30 |
| country optional | query | Two-letter code from targeting_countries in GET /catalog |
| protocol optional | query | http, socks5, default http |
curl -H "Authorization: Bearer $GT_KEY" "https://ghostconnect.io/api/v1/proxies/residential/obcl4126/connection-string?session=sticky&minutes=10&country=de"
GET/invoices
The latest 100 invoices, newest first. GET /invoices/{id} returns one, with the proxies it created. Status is one of completed, credited (paid, not deliverable, refunded to the balance), or a payment state for website payments still in progress.
curl -H "Authorization: Bearer $GT_KEY" https://ghostconnect.io/api/v1/invoices
