# Tokens, proxy products, and hubs

Litport separates the credential you buy from the network location you connect to and the upstream proxy that exits to the target.

## Request path

```text
client -> chosen Litport hub/ingress -> Litport routing -> selected upstream proxy -> target
```

A **token** is the proxy credential and commercial/accounting unit. A **hub** is a Litport ingress relay. The hub is not the exit country, region, city, ASN, or proxy pool.

## Unlimited and PPG tokens

| Product | Commercial model | Connection details |
| --- | --- | --- |
| Unlimited | Prepaid access until its expiration | Use its assigned hub and ingress protocol |
| Pay per GB (PPG) | Balance-backed access measured by upload plus download traffic | Select the pool per exported credential, or lock the token to one pool; choose an eligible hub and HTTP or SOCKS5 |

Unlimited tokens work only with their assigned hub and protocol. PPG tokens are reusable credentials: Configure & export chooses an eligible hub and protocol. Flexible tokens add the selected pool to the username; fixed tokens always use their saved pool. A PPG token's saved hub/protocol are exporter preferences, not authorization constraints.

## Proxy ingress

Use the endpoint shown for the token in the dashboard. Current default ports are:

| Hub family | HTTP | SOCKS5 |
| --- | ---: | ---: |
| Mobile and general | `1337` | `5337` |
| Datacenter and ISP | `31337` | `35337` |

A hub may supply an explicit custom port, which takes precedence. The dashboard endpoint is authoritative for a particular token.

HTTP ingress accepts forward-proxy requests and `CONNECT` tunnels. SOCKS5 ingress accepts supported SOCKS5 commands. Their authentication and error representations differ; see [Proxy error reference](/docs/proxy-errors).

## Credentials are purpose-specific

- Send the proxy username and password to the proxy endpoint.
- Use a token ID only to identify a token after authenticating to the account API.
- Send a user API key only to `https://litport.net/api/v1/...` in a Bearer header.

Do not use a user API key as a proxy password.

## Next steps

- [Understand connection, request, and speed controls](/docs/proxy-limits)
- [Build current PPG usernames](/docs/ppg-proxies)
- [Diagnose proxy failures](/docs/proxy-errors)
- [List token metadata](/docs/api/tokens)