Tokens, proxy products, and hubs
Litport separates the credential you buy from the network location you connect to and the upstream proxy that exits to the target.
Request path#
client -> chosen Litport hub/ingress -> Litport routing -> selected upstream proxy -> target
A token is the proxy credential and commercial/accounting unit. A hub is a Litport ingress relay. The hub is not the exit country, region, city, ASN, or proxy pool.
Unlimited and PPG tokens#
| Product | Commercial model | Connection details |
|---|---|---|
| Unlimited | Prepaid access until its expiration | Use its assigned hub and ingress protocol |
| Pay per GB (PPG) | Balance-backed access measured by upload plus download traffic | Select the pool per exported credential, or lock the token to one pool; choose an eligible hub and HTTP or SOCKS5 |
Unlimited tokens work only with their assigned hub and protocol. PPG tokens are reusable credentials: Configure & export chooses an eligible hub and protocol. Flexible tokens add the selected pool to the username; fixed tokens always use their saved pool. A PPG token's saved hub/protocol are exporter preferences, not authorization constraints.
Proxy ingress#
Use the endpoint shown for the token in the dashboard. Current default ports are:
| Hub family | HTTP | SOCKS5 |
|---|---|---|
| Mobile and general | 1337 |
5337 |
| Datacenter and ISP | 31337 |
35337 |
A hub may supply an explicit custom port, which takes precedence. The dashboard endpoint is authoritative for a particular token.
HTTP ingress accepts forward-proxy requests and CONNECT tunnels. SOCKS5 ingress accepts supported SOCKS5 commands. Their authentication and error representations differ; see Proxy error reference.
HTTP vs HTTPS proxy endpoint#
Every HTTP proxy endpoint also accepts https:// on the same host and port. Only the URL scheme changes:
| Scheme | Example |
|---|---|
| Plaintext | http://USER:[email protected]:1337 |
| TLS to the proxy | https://USER:[email protected]:1337 |
TLS is between your client and the hub. It protects your proxy credentials, the CONNECT target hostname, and plain-HTTP requests on that hop. It does not change what the target sees: the target still sees the selected upstream exit IP, and Litport still routes the request.
| Pros | Cons | |
|---|---|---|
| HTTPS ingress | Credentials and destinations stay private on untrusted networks; passes networks that block plain proxy traffic | Your client must trust the Litport root for the proxy hop; one extra TLS handshake per connection; TLS overhead on the proxy hop counts as traffic for non-cache requests; some clients (for example Scrapy) need an extra handler |
Use the hostname endpoint shown in the dashboard, not an IP address. The hub presents a certificate issued by the Litport cache root, so your client must trust that root for the proxy connection: install it as described on that page, or pass it as the proxy CA (for example curl --proxy-cacert litport-cache-root.crt). Trusting the root does not enable cache mode; only a _cache- password suffix does. SOCKS5 has no TLS variant. Read HTTPS proxy endpoint for the threat model, why curl -k does not apply to the proxy leg, and verified examples for each client.
curl --proxy-cacert litport-cache-root.crt -x https://USER:PASS@HUB:PORT https://example.com
Credentials are purpose-specific#
- Send the proxy username and password to the proxy endpoint.
- Use a token ID only to identify a token after authenticating to the account API.
- Send a user API key only to
https://litport.net/api/v1/...in a Bearer header.
Do not use a user API key as a proxy password.