Every dashboard action is available over HTTPS. Create a key, then call /api/... or the alias /v1/.... Browsers still launch on the machine whose agent is connected for the account that owns the key. Full writeup with request/response examples: docs/API.md in the repo.

Get a key

1. Sign in to the dashboard.
2. Run the agent for that same account (browsers will not open without it).
3. Open the sidebar API tab → + Create key.
4. Copy the secret (pbk_live_…). It is shown once. Max 20 active keys per account.

The key has the same role and tenant as your login. Revoke it on that tab; deleting the account revokes it too.

Auth

Send the key on every request:

Authorization: Bearer pbk_live_…

Same thing: header X-API-Key. The secret is shown once at creation and stored as a hash. A key inherits that account’s role and tenant. Revoking it is immediate. Max 20 active keys per account.

Quick start

export API=https://proxy.sporttickets.uk
export KEY=pbk_live_YOUR_KEY

curl -s -H "Authorization: Bearer $KEY" $API/api/me

curl -s -H "Authorization: Bearer $KEY" $API/api/profiles

curl -s -X POST -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"club":"arsenal"}' $API/api/profiles/378/open

curl -s -H "Authorization: Bearer $KEY" $API/api/profiles/378

curl -s -X POST -H "Authorization: Bearer $KEY" $API/api/profiles/378/close

Python / JavaScript

import os, time, requests
API = os.environ["API"].rstrip("/")
H = {"Authorization": f"Bearer {os.environ['KEY']}"}

requests.get(f"{API}/api/me", headers=H).json()
requests.post(f"{API}/api/profiles/378/open", headers=H, json={"club": "arsenal"}).json()
for _ in range(15):
    live = requests.get(f"{API}/api/profiles/378", headers=H).json().get("live") or {}
    if live.get("state") == "running":
        break
    time.sleep(1.5)
requests.post(f"{API}/api/profiles/378/close", headers=H)

const API = process.env.API;
const H = { Authorization: `Bearer ${process.env.KEY}`, 'Content-Type': 'application/json' };
await fetch(`${API}/api/profiles/378/open`, { method: 'POST', headers: H, body: JSON.stringify({ club: 'arsenal' }) });
const live = await fetch(`${API}/api/profiles/378`, { headers: H }).then(r => r.json());
await fetch(`${API}/api/profiles/378/close`, { method: 'POST', headers: H });

Errors & roles

Failures are { "error": "…" }. Plan limits also send limit, current, max, plan.

A tenant-user key sees own + shared profiles. Tenant-admin sees the tenant. Admin sees everything. Opening a browser requires that user’s agent.

API keys

Profiles

Ids start at 0. browser is chrome or camoufox.

Browsers

POST /api/profiles/:id/open
{ "club": "arsenal" }   // or omit / null for Block Bypass off

POST /api/profiles/:id/block-bypass
{ "club": "arsenal", "reload": true }   // running browser; no Chrome restart

POST /api/profiles/:id/close
POST /api/quick-open
{ "browser": "camoufox", "club": "chelsea" }

?screen=0 on open skips the pre-launch proxy screen. Open returns blockBypass.activated so you can see whether the club cookie was applied, and blockBypass.queueToken when a fresh Queue-it URL was used for the first navigation. An empty pool or a down upstream still starts the browser.

Block Bypass

GET /api/block-bypass/clubs → arsenal, chelsea, tottenhamhotspur, cp. Pass that id as club on open, quick-open, or as blockBypassClub on create/patch.

Sessions

Agents

GET /api/agents — connected agents and their open browsers (state, ip, bandwidth, block, optional phase preparing/starting while launching). Tenant-users only see their own agent.

Proxies

Tenants, accounts, billing

Tenant-admin or admin, as in the dashboard.

Meta

No auth: GET /api/health, GET /api/agent-version, GET /api/openapi.json.

GET /api/me · GET /api/time. CORS is open on /api and /v1.

Agent binary download stays GET /download/agent/:platform?token=AGENT_TOKEN (darwin-arm64, darwin-amd64, windows-amd64).