# Authentication and proxy credentials

Vital has two separate credential types:

1. proxy credentials used to connect to the proxy network; and
2. a Vital API key used to manage supported resources through the public API.

Do not substitute one credential type for the other.

## Proxy credentials

Create an account at [vital-data.io](https://www.vital-data.io), open the
dashboard, and create or select a residential, mobile, or ISP profile. The
dashboard displays the gateway host, port, username, password, and supported
connection formats for that profile.

Residential and mobile connection strings can also be generated through the
public API. ISP package responses contain the static proxies assigned to that
package.

Proxy authentication uses:

- username and password for HTTP and SOCKS5 connections; or
- IP allowlisting where the selected product supports it.

Treat proxy passwords as secrets. Rotate profile credentials from the dashboard
or the corresponding public API endpoint if they are exposed.

## Public API authentication

Base URL:

```text
https://api.vital-data.io
```

Create or rotate the API key in:

```text
https://www.vital-data.io/dashboard/settings?tab=developer
```

Send the key in every API request:

```http
X-Vital-Api-Key: YOUR_API_KEY
```

Example:

```bash
curl \
  -H "X-Vital-Api-Key: $VITAL_API_KEY" \
  https://api.vital-data.io/public/residential/packages
```

The public API currently supports:

- listing residential and mobile packages;
- creating, renaming, deleting, funding, and rotating credentials for
  residential and mobile profiles;
- generating residential and mobile proxy connection strings;
- listing ISP packages and proxies;
- renaming ISP packages.

Purchasing, checkout, and automatic top-up configuration remain dashboard
workflows.

## Rate limits

Limits apply per API key in 10-second windows:

| Operation class  |       Limit |
| ---------------- | ----------: |
| Reads            | 60 requests |
| Profile changes  | 20 requests |
| Proxy generation | 10 requests |

An API request that exceeds its limit returns HTTP `429`.

## Security

- Keep API keys and proxy passwords in a secret manager.
- Never embed them in browser code, public repositories, logs, or support
  screenshots.
- Use separate keys between environments where possible.
- Rotate a credential immediately if it may have been exposed.

See the complete schemas and examples in the
[Vital Data API reference](https://docs.vital-data.io/).

Related: [targeting](https://www.vital-data.io/docs/targeting.md) ·
[session control](https://www.vital-data.io/docs/session-control.md) ·
[products](https://www.vital-data.io/products.md)

Last reviewed: 2026-07-24.