Quickstart: credential to first request

This is the fastest path from a blank dashboard to a working proxied request. No tickets, no onboarding call, a credential is live the moment you create it.

1. Create a credential

In the dashboard, click create and give it a label that tells you what's using it later, crawler, price-monitor. You'll get back:

• An opaque username, like mlabs_a1f9c3
• A password, shown exactly once

That password is generated at high entropy and never stored on our end. Copy it now, if you lose it, you rotate it, you don't recover it.

2. The connection string format

Every credential connects through the same gateway, on the same host, with session behavior encoded entirely in the username as a suffix:

<username>[_loc_<CODE>][_sticky]

• No suffix: rotating, a fresh exit IP on every request. This is the default.
• _sticky: pin one exit IP for about 60 seconds, for flows that need session continuity (logins, multi-step checkouts). See Rotating vs sticky sessions and location targeting.
• _loc_<CODE>: restrict exits to one US location, e.g. _loc_ORD for Chicago. Combine it with _sticky by putting the location first: mlabs_a1f9c3_loc_ORD_sticky.

The gateway itself is proxy.masklabs.io, port 8080 for HTTP and port 1080 for SOCKS5.

3. Make your first request

Rotating, over HTTP, with curl:

curl -x "http://mlabs_a1f9c3:<PASSWORD>@proxy.masklabs.io:8080" \
  https://ipinfo.io/json

Run it twice and watch the ip field change between calls, that's rotating behavior, with no configuration.

Sticky, pinned to one location, over SOCKS5:

curl -x "socks5h://mlabs_a1f9c3_loc_ORD_sticky:<PASSWORD>@proxy.masklabs.io:1080" \
  https://ipinfo.io/json

We use socks5h rather than socks5 deliberately, the h tells the client to resolve DNS through the proxy instead of locally, so the lookup happens from the same location as the exit, with no DNS leak back to your own network. Run this one a few times inside the same minute and the IP should stay put.

4. Point your actual client at it

Anything that accepts a standard proxy URL takes the same string, requests in Python, axios or undici in Node, a headless browser. See Python, Node.js, and browser automation for language-specific setup.

If your tool wants the split form instead of a single URL, it's the same four pieces, in order:

proxy.masklabs.io:8080:mlabs_a1f9c3:<PASSWORD>

host:port:username:password. Swap the port to 1080 and the scheme to SOCKS5 wherever your client expects it.

5. Watch the usage land

Every credential reports live usage in the dashboard, in gigabytes. There's no separate step to "start metering", the balance your organization already funded starts draining the moment a request goes through, and you can see exactly which credential is spending it. See Billing and data usage, explained for how that works underneath.

6. Rotate when something looks off

If a key leaks, or a sticky session gets stuck on an exit you don't want anymore, you don't file a ticket. Rotate the password from the dashboard for a fresh secret, or let a sticky session's minute expire for a fresh pinned IP next time. Disabling a credential is one click, and it stops drawing on the shared balance immediately.

That's the whole loop: create, copy the string, request.