Authentication
Authenticate every request with a Bearer token that belongs to your organization.
Authentication uses only the Authorization header. Cookies are not accepted, and the token cannot be sent in the URL (as a query parameter). Every endpoint expects the same header.
Authorization: Bearer pxn_live_…Bearer followed by the token. Requests with no token or a malformed one get 401 unauthorized.
Why only the header
URLs end up in server logs and in the Referer header; a token carried in the URL leaks there. Not accepting cookies also removes the cross-site request forgery (CSRF) surface entirely.
Base URL
https://api.proxynet.io/api/v1First request
curl -H "Authorization: Bearer pxn_live_…" \
https://api.proxynet.io/api/v1/meThe response contains the token's name, its scopes and the organization it belongs to. A request to an endpoint whose scope the token lacks returns 403 insufficient_scope; which scope opens which endpoints is on the Tokens and scopes page.
Keep your token safe
- Keep the token in an environment variable or a secrets manager.
- Give each integration its own token; if one leaks, you revoke only that one.
- Choose only the scopes you need. A monitoring server does not need
orders:write. - Token creation and revocation events show up on the organization's Activity page.
FAQ
Can I send the token in the URL?
No. A query parameter such as ?token= is not accepted; only the Authorization header is read.
Can I call the API from a browser?
No. The API does not allow browser calls through CORS. The Try it! panel in these docs sends requests through our own proxy; in your own front end, make the request from your own server.
Can one token access more than one organization?
No. A token belongs to the organization it was created in. For another organization's services, create a separate token in that organization.