Proxies.ai

Secure Sharing

Issue expiring, use-limited proxy capabilities without revealing API keys.

Secure shares are expiring proxy capabilities. They let another person call an API through your Hyperproxy without receiving the API credential stored in its vault.

Create a share

  1. Open a running Hyperproxy in the dashboard and select Secure Shares.
  2. Choose a lifetime from five minutes to thirty days.
  3. Set the maximum accepted request count.
  4. Select a vault. The share can only reach hosts bound to that vault.
  5. Create the share and copy its proxy URL.

Use the proxy URL

HTTPS_PROXY='https://share:<capability>@proxy-host:<port>' \
  curl https://api.openai.com/v1/models

The URL is a bearer capability. Send it through a secure channel and never place it in source code, issue trackers, shell history, or logs.

Enforcement

  • Managed TLS termination happens at the edge before traffic reaches the per-share gateway.
  • The sidecar stores only a SHA-256 hash of the capability token.
  • Each accepted HTTP request or CONNECT tunnel atomically consumes one use.
  • Denied vault hosts do not consume a use.
  • The dedicated listener closes immediately after the final use and within one minute of expiry.
  • Traffic still follows the proxy's firewall rules, blocklists, access logging, and credential-injection controls.

Revoke early

Revoke an active share from the dashboard or run cifp share remove <share-id>. Hyperproxy removes the share's edge route and closes the listener.

Provider support

Direct shares currently require managed TLS termination, available in most regions; share creation is rejected where it isn't available.