AvocadoVPN uses standard HTTP Basic authentication in the Proxy-Authorization header of every CONNECT request. No custom SDK, no bearer tokens, no OAuth handshakes at the proxy layer — every HTTP client that supports proxy-auth works out of the box.

​
Credential format

FieldValue
Usernameavp_live_<12-char-hex> (or avp_test_* for test mode)
Password64-char hex secret (returned once at mint / rotate)
The client libraries (curl, requests, scrapy) handle the Proxy-Authorization: Basic ... header encoding for you. You pass http://username:password@host:port and they do the base64 themselves.

​
Three ways to pass credentials

​
Test vs live mode

Keys come in two flavours, distinguished by prefix:
PrefixBehaviour
avp_test_*Request metering runs but no billing. Great for CI / scripted QA. Stop working if you set liveMode: false explicitly at mint; stay in test mode indefinitely.
avp_live_*Real billing. Overage charges (if opted-in) hit your Stripe source. Use these for production.
Always use a test key in shared repositories / CI, live keys in your secrets manager only. See Rotating secrets for rotation best practice.

​
Security — what the gateway does with your secret

  1. Base64-decoded once on every CONNECT.
  2. Looked up by keyId in the DB; secret is never stored in plaintext — only bcrypt(secret, 12).
  3. Successful bcrypt.compare caches the (keyId, secret) pair in memory for 30 seconds to keep hot paths below 1 ms.
  4. On rotation, the gateway cache is flushed immediately — the old secret stops being accepted within milliseconds, not waiting for the 30-second TTL.
We will never ask you to send your secret anywhere other than a CONNECT request to api.atlasvpn.live:7777 over the wire protocol documented here. Any URL / email / form that does is a phishing attempt — report to security@atlasvpn.live.