Skip to content

Managing Proxy Credentials

Use the Credentials page to generate a temporary Proxy Credential or to create, review, rotate, and revoke a persistent Proxy Credential.

Required role

You must be an ADMIN to access credential management, view persistent-credential metadata, or perform any credential action in the current customer interface. A VIEWER does not currently have read-only access to the Credentials page.

Creating a temporary credential

Temporary credentials are intended for short tests and debugging. The current generator creates Pool access for one selected Gateway and displays connection details for that Gateway's system-managed pool-all Pool. It does not create direct Node access.

Before you begin

  • Have an ACTIVE Gateway.
  • Confirm that the Gateway host and the default pool-all Proxy port are available in the Credentials page.
  • Be ready to store the password before closing the result. It cannot be retrieved later.

Generate and save the credential

  1. Open Credentials and find Temporary Credentials.
  2. Select the ACTIVE Gateway through which the credential will be used.
  3. Review the displayed Gateway, Gateway host, default Proxy pool-all, and default Proxy port.
  4. Select Generate Temporary Proxy Credentials.
  5. Save the username and password in an approved secret manager.
  6. Record the displayed TTL and Expires At values.
  7. Use Copy Credentials or Copy curl command if helpful, then close the result only after the secret has been stored.

MyOwnProxy determines the lifetime; the customer workflow does not provide a duration control. The generated TTL and expiration time are authoritative for that credential.

The credential works only for Pool entry points on the selected Gateway. It is not listed after the result is closed, cannot be retrieved or rotated, and expires automatically. The current customer interface does not provide a revoke action for a temporary credential.

Creating a persistent credential

Persistent credentials are intended for ongoing applications and integrations. A credential created in the current customer interface is Customer-scoped and can authenticate both Pool and direct Node connections through the Customer's applicable Gateways.

Create and save the credential

  1. Open Credentials and select Create credential.
  2. Enter a nonempty descriptive name of up to 255 characters for the application or integration that will use it.
  3. To set an expiration, select a future date and optionally a time under Expires at.
  4. Leave the date blank if the credential should have no automatic expiration. If you select a date but leave the time blank, MyOwnProxy uses 23:59 in your local time.
  5. Select Create credential.
  6. Save the generated username and password in an approved secret manager before closing the result.
  7. Allow approximately 30 seconds for the new credential to propagate to the Customer's Gateways, then verify it with a new SOCKS5 connection.

The password is shown only in the creation result. It cannot be retrieved later. The username and non-secret metadata remain available in the persistent-credential list.

The current customer interface does not let you add, remove, or change a persistent credential's expiration after creation. If the expiration policy must change, create and validate a replacement, update the application, and revoke the old credential.

Storing credentials securely

  • Put passwords in an approved secret manager, not in source code, documentation, tickets, chat, or logs.
  • Limit access to the people and systems that operate the intended application.
  • Use a separate persistent credential for each application or integration when independent rotation and revocation are important.
  • Treat copied commands as secrets when they contain a username or password.
  • Rotate a persistent credential if its password may have been exposed. If a temporary password may have been exposed, stop using it and generate a replacement, but remember that the earlier credential remains valid until its displayed expiration time.

Viewing credential status

The persistent-credential list shows each credential's name and ID, username, status, expiration, creation time, and last update time. It does not show the password.

The default filter is Active. Use Expired, Revoked, or All to find credentials in other lifecycle states. Use these filters to review credentials in other lifecycle states. Expired and revoked credentials cannot authenticate. Rotate and Revoke are available only for Active credentials.

Temporary credentials do not appear in this list and have no customer-visible history after the generation result is closed.

Rotating a persistent credential

Rotation replaces the password on the existing credential. The credential keeps the same name, ID, username, endpoint scope, and expiration time. The previous and replacement passwords do not have a guaranteed overlap period.

Plan a brief transition for applications using the credential:

  1. Identify every application instance that uses the credential and arrange a change window.
  2. In the Active credential list, select Rotate.
  3. Store the replacement password immediately; it is shown only once.
  4. Update every application instance with the replacement password.
  5. Allow approximately 30 seconds for the change to propagate across the Customer's Gateways.
  6. Open a new SOCKS5 connection and verify that the replacement password works.
  7. Confirm with another new connection that the previous password no longer works before ending the change window.

During propagation, authentication results can differ between Gateways or between the old and replacement password. Applications that reconnect during the transition may fail briefly. Do not treat the old password as a fallback after rotation.

An Expired or Revoked credential cannot be rotated in the current customer interface. Create a replacement instead.

Revoking a persistent credential

Revocation permanently marks the credential as Revoked. The current customer interface does not provide reactivation.

  1. Identify applications using the credential and decide whether they must be stopped or moved to a replacement.
  2. Create and validate a replacement first if service must continue.
  3. In the Active credential list, select Revoke.
  4. Review the credential name and impact, then confirm Revoke credential.
  5. Allow approximately 30 seconds for revocation to propagate across the Customer's Gateways.
  6. Use a new SOCKS5 connection to confirm that the revoked username and password no longer authenticate.
  7. Select the Revoked filter and confirm the credential's status.

Revoking a credential does not delete its metadata immediately and does not delete a Proxy, Pool, Node, or Gateway. It also does not guarantee immediate termination of already established connections. Stop affected clients or close existing connections separately when access must end urgently.

Expiration

Temporary and persistent credentials handle expiration differently:

  • A temporary credential always has an expiration. The generation result shows its exact TTL and expiration time, and no manual action is required for it to expire.
  • A persistent credential can have an expiration selected during creation or no automatic expiration. After its expiration time, its visible status is Expired and new authentication attempts are rejected.

Expiration does not delete related resources and does not guarantee immediate termination of established connections. An expired persistent credential cannot be reactivated or rotated in the current customer interface. Create a replacement if access must continue.

Verifying a credential

Always verify with a new SOCKS5 connection; do not reuse an established connection.

  1. Confirm that the selected endpoint is served by a healthy, ACTIVE Gateway.
  2. Confirm that the credential scope matches the endpoint: the selected Gateway for a temporary credential, or the same Customer for a persistent credential.
  3. For a temporary credential, use a Pool endpoint. For a persistent credential, use a Pool or direct Node endpoint as intended.
  4. Confirm that the credential has not expired and, for persistent credentials, is Active.
  5. After creating, rotating, or revoking a persistent credential, allow approximately 30 seconds for propagation before drawing a final conclusion.
  6. Start a new connection and verify the expected success or rejection.

If authentication still behaves unexpectedly, check the exact username and current password, the endpoint host and port, Gateway health, Proxy and Pool availability, and Node health. See Using the Proxy, Observability, and Authentication Problems.

Operational considerations

  • Credential changes and Proxy changes are independent. Deleting a Proxy does not revoke either credential type.
  • Replacing or reassigning a Node does not by itself require a new credential. Update connection details only when an application uses a direct Node endpoint that changed.
  • A temporary credential remains bound to the Gateway that generated it. Generate a new one when testing through a different or replacement Gateway.
  • A persistent credential applies across the Customer's applicable Gateway endpoints after propagation; a Gateway replacement does not by itself require a new persistent credential.
  • If a persistent password is lost, rotate the credential. If a temporary password is lost, generate another temporary credential.
  • Keep enough information outside the secret itself to identify its owner, purpose, and expected retirement date.