Referinta API
API mobileproxy.app
Gestionati dispozitive, proxy-uri, rotatie si consum printr-un singur API REST cu token bearer. Lipiti un token mai jos si testati live orice endpoint. Specificatie citibila de masina: openapi.json.
This console hits your real account
There is no sandbox and no dry-run mode. Every request goes to the production API as your account: a rotate call rotates real phones, a DELETE revokes a real proxy, token, or rotation link, and a write against a subscription is a write against the thing you are billed for. Read the request you have assembled before you send it. The token you paste stays in this page's memory and is never written to browser storage — and if you are only looking around, paste a read-only key rather than a full one.
Creati unul din panou (sau POST /tokens cat timp sunteti autentificat). Stocat doar in acest browser.
Se incarca specificatia…
Bearer tokens, shown once
Paste an account token — it starts mpx_live_ — and the console sends it as a bearer header on every call. The raw value exists exactly once, at creation: only its sha256 hash is stored, so a token you lose gets replaced, never recovered. Tokens beginning mpxdev_ are a different thing: per-phone credentials issued at pairing and used by the Android app itself. Those endpoints appear in the list below and will refuse your account token, which is expected rather than a broken console.
Scoped and read-only keys
Paste a read-only key while you are still clicking around: it is refused on every write, so exploring cannot change anything. Two GETs are refused as well, because they hand back a live rotation credential rather than data. A subscription-scoped key narrows things further, reaching only /me and that subscription's own subtree. The trade-off is plain: a read-only key cannot exercise the write paths you probably came to test, so swap in a full token when you actually mean it. No mpx_live_ token reaches admin surfaces, scoped or not — admin requires a browser session, and that is deliberate.
From a working request to a script
Start with GET /me. It confirms which account the token resolves to, and it is the quickest way to tell a bad paste from a bad request. POST /proxies/rotate is the one to slow down on: it queues a rotation on live phones rather than applying it on the spot, and it refuses an empty body, so you have to name all or specific subscription_ids before anything moves. Once a call works here, the method, path, and body carry straight over to curl or whatever client you are building.
For the narrative walk-through of auth, errors, and copy-paste recipes, read the API guide; for every endpoint enumerated resource by resource with its parameters and response shapes, read the API reference.