Private node

Private VPN node: your server, invite-only

Make a node private and it leaves the public marketplace: only accounts that redeem one of your invitations can see it and connect. It runs the same software, transports and per-GB billing as any node, so friends, family or a team get a VPN on a server you chose.

Run a node Operator guide

01 /What “private” changes

Hidden. The node disappears from the marketplace and from automatic route choices for every account without access.
Checked at connect. An account without access is refused, even if it knows the node’s ID.
Still yours. Switching a node to private gives your own account access automatically, so it stays in your view.
Everything else stays the same: the node’s transports (Reality, plus Hysteria2, XHTTP and olcRTC where they are enabled for the node), direct and 2-hop routes, the 1 TON stake and your payouts.

02 /Set it up

Step 01

Add your node

Sign up as an operator, add the node in the dashboard and install the agent on your server with the command shown there (Docker, amd64 or arm64). Adding a node stakes 1 TON from your balance, returned when you delete the node.

Step 02

Switch it to private

Tick “Private node (invitation only)” when you add the node, or later in the node’s Settings.

Step 03

Create invitations

Open Invitations on the node card and pick a type: single-use, 10 uses for 30 days, unlimited, or your own limits. Add a label so you know who each one is for.

Step 04

Send the code

Copy the code or the magic link and send it privately. It is shown only once; if you lose it, revoke it and create a new one.

03 /How invited people connect

They open your magic link, or enter the code under “I have an invite code” in the marketplace. The link shows the node’s country, price and speed first.
They sign in to ProofKit, or create an account, and redeem the invitation.
The node appears in their marketplace with an “Invited” badge. They top up a balance and connect, and it shows up in their app like any other line.

04 /What it costs

You: your server, and the 1 TON stake per node, returned when you delete the node. Going private costs nothing extra.
The people you invite: your price per GB plus the 20% network fee, from their own balance. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves. On a direct route you receive 80% of what they pay, paid out on-chain to your TON wallet.
Your price: you set it and can change it once every 24 hours, raising it at most threefold at a time. Each session keeps the price it started with (olcRTC traffic aside, from 20 November 2026).
Using it yourself: operator accounts cannot connect to the VPN, and nobody can connect to their own node from the marketplace. Create a separate user account with its own wallet, redeem one of your invitations with it, and it pays like any other invited user.

05 /Managing access

See how each invitation is used. The Invitations list shows how many times each one was redeemed and how many of those people still have access. Invited people stay anonymous to you, as all users do. You get a notification each time an invitation is redeemed.
Revoke an invitation to stop new redemptions, and tick the box to also remove the access it already gave.
Revoking stops new connections at once and removes the node from that person’s marketplace. A session that is already open keeps running until it ends; close it from the node’s session list in your dashboard.
Give each person their own single-use invitation. Then revoking one invitation removes exactly one person, and nobody can pass a multi-use code on.

06 /What private does not do

It controls who can connect, not who can find the server. The node’s IP address is public like any server’s, and a censor can still find and block it.
It does not change what the node can see. As the operator of the exit, you are the party the no-logs page describes: the node software keeps no access logs, and your invited people are trusting you with the rest.
It earns only from the people you invite: a private node gets no traffic from the public marketplace.

// faq

Common questions

What makes a node private?

The “Private node (invitation only)” switch, when you add the node or later in its Settings. The node leaves the public marketplace, and connections from accounts without access are refused.

How do people get access?

You create an invitation on the node (single-use, 10 uses for 30 days, unlimited, or custom) and send them the code or the magic link. They sign in, redeem it, and the node appears in their marketplace.

What does a private node cost?

Nothing extra for being private. You stake 1 TON per node, returned when you delete it, and pay for your own server. The people you invite pay your price per GB plus the 20% network fee from their own balance, and you receive 80% of it on a direct route. olcRTC traffic is the exception: from 20 November 2026 it has one network-wide price per GB, read when the traffic moves.

Can I use my own private node?

Yes, through a separate account. Operator accounts cannot connect to the VPN, so create a user account with its own wallet, redeem one of your invitations with it, and connect like any invited user.

How do I remove someone?

Revoke the invitation you gave them and tick the box to remove the access it gave. That stops new connections at once; a session they already have open keeps running until it ends, and you can close it from the node’s session list.

// run a node

Put a private node on your own server

Sign up as an operator, add a node and run the install command from your dashboard on any Linux server with Docker. Then switch it to private and send your first invitation.

Run a node Operator guide

install the agent

# token from your operator dashboard

$ bash <(curl -sSL https://proofkit.org/install.sh) \

--mode=docker --type=origin --token=YOUR_TOKEN

# then: Settings → Private node

// related