April 9, 20266 min read

From credential to first request: a Masklabs quickstart

By The Masklabs team

This is the fastest path from a blank dashboard to a working proxied request. No tickets, no onboarding call, a credential is live the moment you create it.

1. Create a credential

In the dashboard, click create and give it a label, something that tells you what's using it later, like scraper-prod or analyst-laptop. You'll get back:

  • An opaque username, like mlabs_a1f9c3
  • A password, shown exactly once

That password is generated at high entropy and never stored on our end. Copy it now. If you lose it, you rotate it, you don't recover it.

2. The connection string format

Every credential connects through the same gateway, on the same host, with the session behavior encoded entirely in the username as a suffix. The base format is:

<username>[_loc_<CODE>][_sticky]
  • No suffix: rotating, a fresh exit IP on every request. This is the default.
  • _sticky: pin one IP for about 60 seconds, for flows that need session continuity (logins, multi-step checkouts).
  • _loc_<CODE>: restrict exits to one of our roughly 49 US locations, e.g. _loc_ORD for Chicago or _loc_NYC for New York. Combine it with _sticky by putting the location first: mlabs_a1f9c3_loc_ORD_sticky.

The gateway itself listens on proxy.masklabs.io, port 8080 for HTTP and port 1080 for SOCKS5.

3. Make your first request

Rotating, over HTTP, with curl:

curl -x "http://mlabs_a1f9c3:<PASSWORD>@proxy.masklabs.io:8080" \
  https://ipinfo.io/json

Run it twice and check the ip field in the response, it'll change between calls, because you're rotating by default.

Sticky, pinned to one location, over SOCKS5:

curl -x "socks5h://mlabs_a1f9c3_loc_ORD_sticky:<PASSWORD>@proxy.masklabs.io:1080" \
  https://ipinfo.io/json

We use socks5h rather than socks5 deliberately, the h tells curl to resolve DNS through the proxy instead of locally, so the lookup happens from the same location as the exit, with no DNS leak back to your own network. This time, run it a few times inside the same minute and the IP should stay put; the city/region fields in the response should also match the location code you pinned.

4. Point your actual client at it

Anything that accepts a standard proxy URL takes the same string, a headless browser, a scraping framework, requests in Python, axios with a proxy agent in Node. If your tool wants the split form instead of a single URL, it's the same four pieces:

proxy.masklabs.io:8080:mlabs_a1f9c3:<PASSWORD>

host:port:username:password, in that order. Swap the port to 1080 and the protocol to SOCKS5 wherever your client expects it.

5. Watch the usage land

Every credential reports live usage in the dashboard, in gigabytes, updating as traffic flows. There's no separate step to "start metering", the balance your organization already funded starts draining the moment a request goes through, and you can see exactly which credential is spending it.

6. Rotate when something looks off

If a key leaks, or a sticky session gets stuck on an exit you don't want anymore, you don't file a ticket. Rotate the password from the dashboard for a fresh secret, or just let a sticky session's minute expire for a fresh pinned IP next time. Disabling a credential entirely is one click, and it stops drawing on the shared balance immediately.

That's the whole loop: create, copy the string, request. Everything else, picking rotating vs. sticky, targeting a location, splitting traffic across credentials, is a suffix or a new credential away, not a new integration.