Developers

Build on the s4m API

Everything in s4m is a REST API — the same one the dashboard and the mobile app use. Automate accounts, issue VPN/proxy access, and query the free-proxy catalog.

Get an API tokenBrowse endpoints
Getting started

Base URL & authentication

All requests go to the versioned base URL over HTTPS. Authenticate by sending your session token as a Bearer header — get one from /auth/login or /auth/token.

  • JSON request and response bodies
  • Bearer token auth (HS256 session JWT)
  • Rate-limited; be a good citizen
bash
# Base URL
https://s4m.online/v1

# Authenticate, then send the token on every call
TOKEN=$(curl -s -X POST https://s4m.online/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"…"}' | jq -r .session)

curl https://s4m.online/v1/me -H "Authorization: Bearer $TOKEN"
Reference

Endpoints

Authentication

POST/v1/auth/registerCreate an account with email + password. Returns a session token.
POST/v1/auth/loginExchange email + password for a session token.
POST/v1/auth/anonymousCreate an anonymous account and token — no email required.
POST/v1/auth/tokenExchange an account token for a fresh session token.

Account

GET/v1/meThe current account: email, role, status, wallet, traffic pool & PAYG pack.
GET/v1/me/usageCurrent usage vs your plan limits.
GET/v1/me/usage/seriesDaily up/down bytes for the last 30 days.
POST/v1/me/subscribeActivate a plan (paid via checkout or voucher).
GET/v1/me/packYour prepaid PAYG traffic balance (bytes remaining).
POST/v1/me/redeemRedeem a voucher code — wallet, traffic pool, pack, or plan days.

Access (VPN & proxy)

POST/v1/me/accessIssue access: returns proxy credentials + a WireGuard config.
GET/v1/me/accessList your active proxy credentials and WireGuard peers.
POST/v1/me/split-tunnelBuild WireGuard AllowedIPs + a PAC file to route only chosen destinations.

Referrals, privacy & webhooks

GET/v1/me/referralYour referral code, link and earned-bonus stats.
POST/v1/me/referral/claimRecord that a referral code referred you (bonus on subscribe).
GET/v1/me/privacyA live summary of exactly what we store about your account.
GET/v1/me/exportDownload all your account data as JSON (GDPR portability).
DELETE/v1/meErase your account: revoke access, cancel subs, scrub personal data.
POST/v1/me/webhooksRegister an HMAC-signed webhook for account events.
GET/v1/me/webhooksList your webhooks and their delivery counts.
DELETE/v1/me/webhooks/{id}Delete a webhook.

Free-proxy catalog

GET/v1/proxiesQuery the live free-proxy list (filter by country, protocol, anonymity).
GET/v1/proxies/facetsAvailable filter facets with counts.
GET/v1/proxies/feedFresh validated feed — format=json|txt|csv, paginated with limit (1–1000) & offset, sortable.

Tools

GET/v1/ipEcho the caller's public IP (what-is-my-ip).
POST/v1/proxy-checkTest a proxy through a fixed echo: alive, latency, exit IP, anonymity.
GET/v1/lookup/{ip}Threat-intel: is this IP a known/live open proxy or an s4m exit? Returns a risk score.
Examples

Copy-paste recipes

Issue proxy + VPN access

bash
curl -s -X POST https://s4m.online/v1/me/access \
  -H "Authorization: Bearer $TOKEN"
# -> { proxy_username, proxy_password, proxy_socks, proxy_http, wg_config }

Query the free-proxy list

bash
# Elite SOCKS5 proxies in Germany, as JSON
curl -s 'https://s4m.online/v1/proxies?country=de&protocol=socks5&anonymity=elite'

Page through the whole feed

bash
# 500 per page, walk offsets; format=json|txt|csv
curl -s 'https://s4m.online/v1/proxies/feed?format=json&limit=500&offset=0'
curl -s 'https://s4m.online/v1/proxies/feed?format=json&limit=500&offset=500'

Check whether a proxy works

bash
curl -s -X POST https://s4m.online/v1/proxy-check \
  -H 'Content-Type: application/json' \
  -d '{"host":"proxy.example.com","port":1080,"protocol":"socks5"}'
# -> { alive, latency_ms, exit_ip, anonymity }

Pull your 30-day usage

python
import requests
H = {"Authorization": f"Bearer {TOKEN}"}
r = requests.get("https://s4m.online/v1/me/usage/series", headers=H)
for d in r.json()["series"]:
    print(d["date"], d["total"])
FAQ

Questions, answered

Is the API stable / versioned?

Yes — endpoints live under /v1. Breaking changes ship under a new version prefix.

How do I authenticate the mobile app?

The same way: obtain a session token from /auth/login or an anonymous token, then send it as a Bearer header.

What are the rate limits?

Auth and sensitive endpoints are rate-limited per IP. Back off on 429 and keep tokens server-side.

Can I automate provisioning for my users?

Yes — resellers create sub-users with per-user quotas via the account API, then issue access programmatically.

Ship faster on s4m

Anonymous accounts — grab a token and start building.

Get an API token

People found this page by searching for

Real search phrases this page answers — the linked ones open the page that covers them in depth.