Without code: the dashboard

This guide is for a business with no backend: a rental, a hotel, a school, an office or a shop that gives its customers or its staff VPN access. You add each person by hand in the partner dashboard on proofkit.org, hand over a link or a QR code, and the access stops when it is over. Nothing here needs a developer, a server or an API key. If your own backend creates subscribers, start with the Partner quick start instead; the dashboard and the Partner API work on the same subscribers, and you can use both.

Become a partner

You sign your partner up yourself, in the dashboard, and nobody at ProofKit approves it. Sign in at proofkit.org (or create a free account) and press Become a partner on proofkit.org/partners, or open #/partner. A checklist takes you through five steps: the one you are on is open, and the ones you have done fold to a line.

1. Account. Confirm the email address of your account. It must be one that signs in with an email address, not only with Telegram, and runs no other partner.
2. Two-factor. Turn on an authenticator app or Telegram codes. The sign-in that signs the partner up must itself have used the second factor, so after turning it on in another browser, sign in again with the code.
3. Your service. A name, which your customers see as the title of their subscription; where your customers are (Russia, Iran, China, Turkmenistan, Europe, Asia or elsewhere); and how you add subscribers: by hand, from your backend, or both. The answers set where you start, and you change every one of them later in the Subscription tab. Saving this step creates your partner, with its billing account, owned by your account. It signs your account's other sessions out, so sign in again where you were signed in.
4. Partner wallet. Link a TON wallet that is only for the partner. It must be a wallet no other ProofKit account is linked to, your own personal account included.
5. Stake and first top-up. One deposit from the partner wallet: a stake of 5 TON and at least 0.1 TON for traffic, so at least 5.1 TON (the page suggests 5.5 TON). Tick the checkbox that accepts the Partner Terms and the Acceptable Use Policy first.

The partner goes live by itself once the deposit has landed: ProofKit reads the escrow every 30 seconds, so this takes about a minute after the transaction confirms. You get an email, and the Subscribers, Balance and Subscription tabs open. Until then nothing is locked: what you deposited is yours to withdraw at any time. A deposit short of the sum stays on the balance, the step says how much more it needs, and deposits add up.

You start with subscriptions on, every exit country and all three transports, and direct routes only unless you named Russia, which adds the routes through the entry in Russia. olcRTC is off until ProofKit switches it on. (For a partner ProofKit sets up by hand, subscriptions are on once ProofKit switches them on; until then the Subscribers tab says so and Add is off.) There is no free trial on this path: every GB is paid for from the first byte. A free trial exists only by agreement with ProofKit. To agree one, or a bigger start, an agreed price, an entry server of your own or olcRTC, talk to us.

The dashboard is for six people or more. Five people or fewer are served by an ordinary ProofKit account: its own subscription link and up to four Extra links, paid from its balance, each with a monthly limit of its own.

You need no API key. The dashboard is #/partner on proofkit.org (the site's navigation shows Partner to the owner account), and it opens only with two-factor sign-in on. The terms are at proofkit.org/partner-terms.

Add a subscriber

Open Subscribers, type the subscriber's number and press Add (or Enter).

What to write as the number. A number from your own records: an order, a booking, a contract. Not a name, a phone number or an email address: it is the only thing ProofKit keeps to tell one subscriber from another, and it should mean nothing outside your system. It can be up to 128 bytes long and is unique within your partner. Capital and small letters differ: A-17 and a-17 are two subscribers. If your records have no numbers, Suggest writes a random code such as K7Q-4MD.

One number, one person. The same number again is the same subscriber, not a second one. The page asks before it touches one that is there already: Use it again enables it if it was disabled, writes the limits the form names on it, and its old link works again; Leave it changes nothing and shows it in the list. The link works again only if the limits leave it running: one whose access had ended needs a new end date, and one whose traffic was used up a new figure, so the page tells you to set it instead of asking. So do not pass a number from one customer to the next. If you must, leave it and press Reset link… first: otherwise the person who had it before has the access again.

You can add 300 subscribers an hour. While a free trial is at its subscriber cap, Add is refused (see What it costs).

Many at once

Add several… opens a box for up to 100 numbers, one a line: a column pasted from a spreadsheet will do. Each gets the limits the form holds at that moment. A line that cannot go is named before anything is sent: a number written twice, one longer than 128 bytes. A line that holds a tab is one too: it is two columns pasted together, and the second would become part of the number.

Several at once only add. A number that is there already is counted and left exactly as it is: not enabled, not given the limits. Such numbers are not lost in the count: they stay in the box, each with the link and the limits it had, for you to look at in the list. If a free trial reaches its cap part-way, the ones before it are added and the rest stay in the box with the reason. Each number counts toward the 300 an hour.

Limits

Four limits can be set when a subscriber is added, each of them optional:

• A length is counted from the moment you press Add. Three days is 72 hours from then, not the end of the third day. A date and a time are read on your own clock, and before anything is sent the form says the moment both ways: Ends 16 Oct 2026, 20:30 your time (UTC+4) · 16:30 UTC.
• Countries opens the list of countries a subscriber can be given, each with the price per GB its routes start from. Left at As in your subscription, the subscriber gets whatever your Subscription tab names, now and after you change it.
• Devices is a whole number from 1 to 100, or empty for no limit.
• The form keeps what you last set, so the next subscriber is a number and Enter. Look at the line under valid for before each Add: a length is counted afresh from that press, and a date you typed is still the same date.

When the end date comes or the traffic is used up, the subscriber's connections end within about 15 seconds (an olcRTC line, if olcRTC is on for you, within 5 minutes) and its link serves no lines; the app shows the access as ended or used up. The subscriber stays in your list, and you can bring it back (see Renew or change).

What a device is. A device is an app install that names itself. Happ, v2RayTun and Ghostlane send a device id each time they refresh the link, and the limit counts those ids. Hiddify, v2rayNG, Streisand and the sing-box apps send none, and Shadowrocket, Karing, Clash Mi and Throne send one only if the customer turns it on; some apps let the customer switch it off, and such an app names no device either. ProofKit keeps a hash of the id, never the id itself, with the model, the system and the app as the app told them, and no address. Opening the link in a browser counts as no device.

Places. The limit is counted in places, and a device holds its place for 30 days after its last fetch, so a phone that stopped refreshing a month ago no longer stands in the way of a new one. A new device, or one that comes back after a month of silence, gets the list while fewer places than the limit are held, and a message in place of servers while every place is held. A device that holds its place keeps getting the list. A device you removed stays removed until you allow it again, with a limit or without one.

Apps that do not name the device. A limit can only count the devices that name themselves, so you choose what the others get. In the Subscription tab, under Devices, Apps that do not name the device is "get no list" or "get the list and are not counted". "get no list" is the default: such an app gets a message in place of servers whenever the subscriber has a limit, because a limit that an app can walk round by not naming its device is no limit. "get the list and are not counted" serves it and counts it nowhere, so it is never limited. The setting reaches every subscriber that has a limit from its next fetch, and a subscriber without a limit is not touched by it. If your customers use Hiddify, v2rayNG or Streisand, choose "get the list and are not counted", or give them Happ, v2RayTun or Ghostlane.

What a device limit does not do. It caps how many devices receive the subscriber's list, not how many connect. Every device of a subscriber connects with the same credentials, so a device that already has the list keeps connecting until its app refreshes and gets the empty list, or until the credentials change. It stops a link forwarded to a friend, pasted into a chat or handed to a second family: the next device gets a message in place of servers. It does not stop someone who copies the server lines out of the app, or runs a relay that sends one device id for everyone, because a device id is the app's word. Reset link… is the lever that cuts everything: it gives the subscriber a new link and ends the connections made with the old one.

What is kept. A subscriber with no limit still has its devices listed. The card lists the 20 most recently seen devices that you have not removed, or as many as the limit when that is higher, and the devices you removed are kept apart, up to 100. A device is forgotten after 180 days without a fetch, within minutes of the 180th day after its last fetch; a removed device is kept.

Hand it over

After an add, Hand over opens by itself; later, QR on the subscriber's row opens it again. It shows:

• the link as a QR code, for the person to scan with a phone's camera at your counter;
• what the subscriber is limited to, its devices included (up to 3 devices);
• Copy link, to send it in a message;
• Share, where the browser has a share sheet (a phone);
• Print, while the setup page is on: a card with your title, the code, the link, the end date and the device limit when it has them, and three steps, to hand over on paper. A subscriber that is disabled, ended or out of traffic gets no card until it is brought back;
• Other links, folded away: the link Ghostlane reads.

On the row, Link copies the same link without showing it, and Ghostlane copies the one that app reads.

A link is the access. Anyone holding it can use it, so give it to that person only. If one gets out, Reset link… in the row's menu makes a new link at once, and the old one stops working.

What the subscriber sees

Opened in a browser, the link is a setup page: your profile title, the end date and the traffic, the device limit when one is set, an app to install (Ghostlane, an open-source client, with its store links), one tap that adds the access to it, the link to copy for Happ, Hiddify, V2Box or another app, and your support link. Past its end date or its traffic the page says so and, if you have set a profile title, to ask you by it. Its words name neither ProofKit nor the subscriber's number. The link itself is on proofkit.org until you have a domain of your own for it: your domain in the Subscription tab, once the free trial is over.

Set the profile title and the support URL in the Subscription tab before you hand out the first link: the title is the name the person sees on the page and in the app, and the support URL is where the page sends their questions. The same tab has the page's switch, setup page. Off, a browser shows the list's text, as an app gets it.

Which lines the list carries. The Subscription tab's transports choose the lines each route carries: Reality, Hysteria2 and XHTTP are on until you change them. WebTunnel, a line that looks like a visit to an ordinary website, for networks that cut the others, is off until you tick it (it is offered once an entry or an exit you can sell serves the line), and a route has it only while its entry or its exit serves it (see WebTunnel).

An app that fetches the link gets the list and never the page, so a link that is already in an app keeps working as before.

Find, renew, stop

The list is newest first and shows each subscriber's status, its traffic and cost over the last 30 days, its limits and when it last moved traffic. A device limit reads 2 of 3 devices; a subscriber with no limit shows how many devices it has, such as 2 devices. The search field finds a number by any part of it, whatever the case. The number you type in whole stands first, however old it is. The chips above the list filter it by state: All, Active, Expired, Used up and Disabled, each with how many subscribers are in it.

One subscriber

A press on a subscriber's number, or Details… in its menu, opens its card: its status and its limits, its Devices, its traffic on each of the last 30 days as bars, with their total and what it cost, and Connected through — the routes it used in the last 24 hours, such as Germany, or Germany via Russia when it enters through another country, each with its traffic in those 24 hours and when it last moved, and how many more routes its link holds unused. A subscriber that used none reads Not connected now. The days are UTC days, so their total can differ a little from the list's "last 30 days", which counts back from this minute.

The card only shows, with one exception: in its Devices block you can remove a device and let it back. Quota, end date, countries, devices… and Hand over on it open the same editor and the same dialog as the row does. There is no button that ends a connection: an app makes its connections again the next time it refreshes the link, so to cut a subscriber off use Disable… or an end date.

Devices lists the devices that fetched the subscriber's link, the one seen last first, and beside its title how many of the limit's places they hold: 2 of 3, or no limit. A row reads like iPhone15,2 · iOS 18.1 · Happ, the model, the system and the app as the app told them, then added 12 Oct, then when the device was last seen: seen today, seen 3 days ago, or not seen for a month once it has lost its place. Remove asks first. After you confirm, the device gets no list from its next refresh until you allow it again, and an app that refreshes drops its servers. A removed device is marked removed and its button reads Allow again. It stays removed, whether or not a place is free, until you press that button. If every place is held, Allow again says so and changes nothing: remove another device or raise the limit first. Remove and Allow again count toward the 100 changes an hour that the editor's saves use.

Renew or change

Quota, end date, countries, devices… in a row's menu (the ⋯ button) opens the editor. It sends only what you changed:

• a later end date renews a subscriber that has ended, or extends one that has not;
• a new traffic figure starts the allowance again from now, and Start the allowance again from now does the same at its present size;
• taking a country away ends the subscriber's connections through it, and Save asks once more before it does;
• a devices number sets the limit, and an empty field takes it off. A limit never removes a device: lowering it under the number of devices the subscriber has keeps every one of them served and admits no new one, until some fall silent for 30 days or you remove them. The editor says where things stand: 2 devices now; 1 removed. Lowering the limit removes none of them.

Moving the date or changing the devices does not start the traffic allowance again, and the other way round. A renewed subscriber keeps its link: the person does nothing, and the app has its lines again at its next refresh. You can save 100 changes an hour.

Stop

• Disable… ends the subscriber's connections at once (an olcRTC line within 5 minutes) and switches its link off: it answers as an unknown link. Enable brings it back with the same link.
• Reset link… replaces the link and ends the connections made with the old one. It also forgets the subscriber's devices, the removed ones too: the customer's own devices add themselves again at their next refresh, and the limit stays.
• Remove… takes the subscriber off your list for good. Its connections end at once and its link stops working, now and later. What it used stays in your totals and in the usage report, because it is part of your bill, and during a free trial it still counts toward the trial's subscribers. There is no undo. Adding the same number again later makes a fresh subscriber: a new link and the limits the add form holds at that moment, with no question asked.
• Change number… gives the subscriber another number: a code from Suggest you did not want, a typing mistake, a number that should have been an order number. Its link, its limits and its traffic stay, so the person who uses it notices nothing. The new number follows the same rule as the first: one from your own records, not a name, a phone number or an email address. A number another subscriber holds is refused, and so is one you removed: add it again to bring that subscriber back.

Reset, Disable, Enable and Change number share 30 an hour with the Subscription tab's saves. You can remove 100 subscribers an hour.

A removed subscriber is not in the list, its counts, the search or the export. A line beside the state chips says how many there are.

The list as a file

Export CSV saves the list as it is filtered on the page, by the search and the chip, as subscribers-YYYY-MM-DD.csv for a spreadsheet: the number, the status, when it was added, until when it is valid, the quota and what is used of it, the traffic and the cost of the last 30 days, when it was last seen, its countries, its device limit and how many devices hold a place. Times are UTC, sizes are GB, amounts are TON. Up to 10,000 subscribers go into one file; past that, narrow the list first.

The cells are parted by commas and the decimals written with a dot. Tick Semicolons for a spreadsheet that writes one and a half as 1,5: the cells are then parted by semicolons and the decimals written with a comma, and the file opens in columns there. The box is ticked for you when your browser writes numbers that way. A number that begins with =, +, - or @ is written with an apostrophe in front, so that a spreadsheet does not read it as a formula.

Links are left out unless you tick Include links. A link is the access: keep a file that holds them as you keep the links.

When something goes wrong

The Overview tab opens with the incidents of the last 7 days that touched your subscribers' routes: a server that was down, an exit that accepted connections and carried nothing, a server that refused or slowed new connections, an olcRTC line that was down, or a network (a mobile operator, for example) on which some of our lines failed. Each row says what happened in one sentence, when it began and when it ended (on your clock and in UTC), how many of your subscribers moved traffic on those lines in the day before it, and what to tell a customer while it lasts: another country in the list, a Direct line, another line of the country, or nothing, when the lines come back by themselves.

An incident is listed once it has lasted 5 minutes (an entry's, 10; a network's, 15). One still going after 10 minutes also rings the bell, once. The same kind of incident rings again only when it begins more than 6 hours after the last bell. An olcRTC carrier that fails in several countries at once is one row. An incident on routes none of your subscribers used is not shown to you. A network is listed only if it is in a country your customers are in, as you answered when you signed up: Russia, Iran, China, Turkmenistan, Europe, Asia or elsewhere. If you gave no answer, every network is listed. To change your answer, open a ticket.

Incidents are opened partner by partner: ask us in a ticket when your Overview does not show them.

Further down the Overview, Torrent Guard lists the times in the last 30 days that Torrent Guard ended a session of one of your subscribers, newest first. A row says when (on your clock, with UTC in the tooltip), the subscriber's number, why in words (address scan, torrent swarm, a BitTorrent client, or the upload and data limits), the transport the connections came in through (Reality, XHTTP, Hysteria2, WebTunnel or olcRTC) when the exit could say, the exit's country, and the numbers behind the decision. It shows the same events your backend reads from GET /guard-events, and it has no buttons: a subscriber that was ended is refused that exit for an hour, and its subscription leaves that exit's routes out for the same hour. The list holds the latest 100, and a line says when there were more.

A new version of our server software goes out at night, between 23:00 and 06:00 UTC. Each server restarts once in that window, and the connections through it drop for a few seconds, far short of the 5 minutes an incident needs to be listed. The bell says so ahead: it names the night and the hours.

What it costs

You pay for the traffic your subscribers move, per GB, from your partner balance. Adding a subscriber, a link, the setup page and the dashboard itself cost nothing. The list's cost · 30 d column shows what each subscriber cost, and countries shows each country's price per GB before you choose it.

• Traffic is charged to the balance from the first byte, and there is no cap on subscribers. At a zero balance your subscribers' connections end, and their links serve no lines until you top up.
• A free trial exists only by agreement with ProofKit, and a partner that signs itself up has none. During one, traffic is free while all three of its limits hold: the end date, the traffic allowance and the subscriber cap. The cap counts every subscriber you have added, disabled and ended ones too, so a business whose customers come and go spends one place for each customer. At the cap, Add is refused: ask us to raise the cap, or top up and ask us to end the trial. Once any limit is passed, the trial is over and the first point applies.
• The stake. A partner that signed itself up has a stake of 5 TON locked from the moment it went live. It is not part of the balance that pays for traffic, and it cannot be withdrawn while the partner runs. The Overview and the Balance tab show it on a stake card. Abuse by you or your subscribers can cost part or all of it: we cut it by hand, with a reason, we email you the reason, and you can appeal in a support ticket. A cut leaves the partner running.
• Close the partner… on the card ends the partner at once: every subscriber is cut off, their sessions end and their links stop working. The rest of the balance can be withdrawn right away. The stake comes back to the balance 30 days after you close the partner, ready to withdraw. Until then Reopen the partner… makes the partner live again at once, with the stake still locked; once the stake is back, reopening locks it again. A partner ProofKit switched off is opened again by ProofKit only.
• The balance is topped up in TON from the partner wallet you linked when you signed up (a partner ProofKit set up by hand links it in the Balance tab). It must be a wallet no other ProofKit account is linked to, your own personal account included.

Everything about money (the stake, the wallet, top-ups, prices, and withdrawing what you did not spend) is in Paying for your subscribers' traffic.

What the Partner API adds

Everything above is also a call of the Partner API, for the day you connect a booking system or a bot: POST /subscribers is Add, PATCH /subscribers/{external_id} is the editor, and the number you type is the API's external_id. A key is made in the dashboard's Overview with Create key. A subscriber added by hand and one made by a call are the same subscriber. The device limit is the API's device_limit, and the card's Devices block is GET /subscribers/{external_id}/devices, DELETE …/devices/{device_id} and POST …/devices/{device_id}/allow: see Subscriber device limit.

Remove… and Change number… are the dashboard's own. To the API, a removed subscriber is a disabled one whose link was reset. It is still in GET /subscribers and in GET /usage, and POST /subscribers with its number enables it again, as for any disabled subscriber. A changed number is the subscriber's external_id from then on: a bot that still asks for the old one finds nobody.

Only the API can read usage over any window and a subscriber's sessions, start a route to a named country or node and read its configs, ask for an olcRTC line, and serve the subscription from your own server. The quick start walks through it.

Back to contents