Endpoint
Plain TCP. HTTP/1.1. No TLS in front — the CONNECT itself is plaintext (the TUNNELLED content is already TLS, since you’re CONNECTing to target:443). This matches how every HTTP proxy in the industry operates; it’s not a security compromise.
CONNECT target.example.com:443 HTTP/1.1
Host: target.example.com:443
Proxy-Authorization: Basic <base64(keyId:secret)>
Proxy-Connection: Keep-Alive
HTTP/1.1 200 Connection Established
<raw TCP tunnel begins here — your HTTP client sends its own request through it>
Allowed target ports
The gateway enforces a narrow port allowlist to prevent the network from being abused as a generic TCP proxy. If you need a port outside this list, email support@atlasvpn.live with the use case.
| Port | Protocol | Status |
|---|
| 443 | HTTPS | ✅ |
| 80 | HTTP | ✅ |
| 8080 | HTTP alt | ✅ |
| 8443 | HTTPS alt | ✅ |
| All others | — | 403 blocked |
Sticky-session username suffix
Extends the keyId portion of the username with optional qualifiers. Order matters: country before session.
avp_live_<hex>[-country-<iso2>][-session-<tag>]
# Pin country = US
curl -x http://avp_live_abc-country-us:secret@api.atlasvpn.live:7777 …
# Pin session for 10 min (any tag, ≤64 chars, [a-z0-9_-])
curl -x http://avp_live_abc-session-scraper-run-42:secret@api.atlasvpn.live:7777 …
# Both
curl -x http://avp_live_abc-country-fr-session-scraper-42:secret@api.atlasvpn.live:7777 …
(keyId, session-tag) pair within that window routes through the same exit node. The gateway refreshes the TTL on every use; a session that’s continuously used never expires.
Country-only (no session): every request picks a fresh node in that country. Use this when rotating IPs per-request is desired (e.g. scraping a site that rate-limits per-IP).
Response codes
| Code | Meaning | Retry? |
|---|
| 200 | Tunnel established — begin your request | — |
| 400 | Malformed CONNECT line | No — fix the request |
| 402 | Bandwidth quota exhausted for current period | No — upgrade or wait for period reset |
| 403 | Port not in allowlist, or admin-suspended key | No — review target port + key status |
| 407 | Proxy authentication required / invalid auth | No — fix credentials |
| 429 | Rate limit — too many CONNECTs per second for your tier | Yes, with backoff |
| 502 | No VPN nodes currently available in requested country | Yes, within a few seconds |
| 504 | Gateway forwarded to a node but node didn’t ACK within 15s | Yes — usually a slow / blocking target |
