Authentication

Signup and email verification are plain JSON endpoints — no browser needed. First, submit an email and password:

curl -X POST https://www.buyproxy.org/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"a strong password","name":"Your Name"}'

# {"ok":true,"cooldownSeconds":60}

A 6-digit code is emailed to that address. Submit it to actually create the account — nothing is written until this call succeeds:

curl -X POST https://www.buyproxy.org/api/auth/verify-otp \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","code":"482913"}'

# {"ok":true,"isNew":true,"user":{"email":"you@example.com","name":"Your Name"}}

Codes expire after 10 minutes. POST /api/auth/resend-otp with the same email reissues one if it lapses.

Get an API key

Log in once at buyproxy.org with the email and password from signup, then create a key from Personal API keys. The raw key is shown exactly once — copy it before leaving the page, there is no way to retrieve it again (create a new one and revoke the old if you lose it).

Use the key

Every call under https://www.buyproxy.org/v1 needs an X-API-Key header:

curl https://www.buyproxy.org/v1/account \
  -H "X-API-Key: bp_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

A missing or invalid key returns 401.

Managing keys

Create as many named keys as you want — one per server or integration is a reasonable default — and revoke any of them independently from the same page. There's no scoping (a key can do anything your account can do) and no fixed limit on how many you keep active.