Use the control API to request a capability. Do not choose a backend, Resin instance, Mihomo port, or permanent token yourself. Proxy traffic goes directly to the returned Dallas gateway; it never traverses Phoenix.
PROXYHUB_API_KEY from the environment. Never print it, embed it in source control, or include the returned proxy password in logs. The password appears only in create/renew responses.GET https://proxy-control.166251356.xyz/api/v1/profiles Authorization: Bearer $PROXYHUB_API_KEY
POST https://proxy-control.166251356.xyz/api/v1/proxy/resolve
Authorization: Bearer $PROXYHUB_API_KEY
Idempotency-Key: <stable unique operation id>
Content-Type: application/json
{
"purpose": "microsoft-login",
"country": "US",
"mode": "sticky",
"session": "account-001",
"protocol": "http",
"access": "tailnet",
"ttl_seconds": 7200,
"strict": true,
"test_before_return": true
}
Use purpose=microsoft-login for Microsoft/Outlook/PxCaptcha, bulk-http for ordinary high-volume web traffic, general for general traffic, and whois for WHOIS. Keep strict=true. Sticky mode requires a non-PII session matching [A-Za-z0-9_-]{1,64}.
Configure the returned scheme, host, port, username, and password in the application's standard proxy client. Query a lease with GET /api/v1/proxy/leases/{credential_id}; renew with POST .../renew; test only advertised preset targets through POST .../test; revoke with DELETE .../leases/{credential_id}.
A query never returns the password. If it was lost, renew the lease or create a new one. Reusing an Idempotency-Key with a different body returns 409. The one-time secret replay window is intentionally short.
Handle machine-readable codes: invalid_api_key, profile_not_allowed, no_compatible_profile, quota_exceeded, and pool_unavailable. Never silently switch pools after an error.