Company

One product, and a list of things we will not sell you

This is the whole commercial description of RoamingProxy: what is sold, what a payment buys, how it is delivered, who sells it, and what it may not be used for. It is deliberately short on adjectives. Every claim here is written to survive being read against the published API reference, the live plan catalog, and the policy documents linked at the foot of this page.

What we do not offer

We do not solve CAPTCHAs — not as a feature, not as an add-on, not on request, and we do not bundle or resell a service that does. There are no residential or mobile addresses: every address we have belongs to an AWS range, and no third-party pool is plumbed in behind it. There is no SOCKS5 endpoint and no host:port proxy string to paste into an HTTP client. There is no headless browser and no JavaScript rendering. There are no search-engine results. There is no scheduler, no hosted crawl queue and no parsing or extraction service — you get the target's bytes and you parse them yourself. We do not sell anonymity or block evasion. If you need any of those, we are the wrong product, and finding that out on this page costs you nothing.

The product, in one sentence

RoamingProxy is a rotating HTTPS proxy and web-scraping API for developers. You send us a URL and a region over HTTPS; we fetch that URL from an egress address we run in that region and hand back what the target said, wrapped in a JSON envelope. There is no browser in the path, no parser and no dataset. There is one fetch, sold by the month.

The published surface is fourteen operations, and the reference at api.roamingproxy.com/v2/docs is public, needs no account and is the authority rather than this page. One operation performs a fetch — POST /v2/proxy/fetch — and two report on it: GET /v2/proxy/regions and GET /v2/proxy/status. Eight are read-only social endpoints across Bluesky, Mastodon and Hacker News, with a ninth, GET /v2/social/platforms, returning the roster itself. Two read the user-agent catalog. If an operation is not in that reference, it is not a thing we sell you.

What a paying account receives

A subscription buys access, not a shipment. Here is the whole of it, itemised, so there is nothing left to infer.

An account and its keys

An account on the dashboard, and API keys you mint yourself. A key begins rp_, is displayed once and is stored only as a digest, so we cannot recover it for you. Keys are scoped per route, each one can be revoked on its own, and no key can manage the account, mint another key or touch billing — those need a signed-in session.

The fetch API

POST /v2/proxy/fetch?region=us-east with an x-api-key header and a body of exactly one field, the URL. The envelope returns the target's body in result, the target's own status, the final_url and redirect count, the egress address the target saw, and the region that actually served.

The social data API, in beta

Read-only endpoints over Bluesky, allowlisted Mastodon instances and Hacker News, returned in one shape. Metered on every call with the rate deliberately unset, so today it is bundled and charged at nothing.

The user-agent catalog

A curated list of user-agent strings, readable over the same API with the same key. It is reference data you choose from and send as your own User-Agent header — we forward yours verbatim and do not substitute or rotate one for you.

A dashboard and an invoice

Screens for keys, a request playground, usage you can reconcile against what you are charged, invoices and webhooks.

The price, and the meter we charge nothing for

The paid plan is called the Web Scraping API. It is $25.00 a month and includes 50,000 requests. Past that the rate is $0.50 per 1,000 requests. The allowance is included volume rather than a hard ceiling — nothing blocks the request after your last included one, it is simply rated — and $25.00 is also the floor, so a quiet month bills the plan fee rather than less.

Prices are in US dollars and exclusive of sales tax, VAT, GST and any similar duty. Where a payment is taken by card, our payment provider acts as merchant of record and is responsible for assessing, collecting and remitting the tax due on that sale, so the amount charged to you includes it and will not match the listed figure exactly. That is the position our Terms and our Refund Policy take, and a product page that disagreed with the contract would be worse than no product page.

A second meter runs and charges nothing. We record egress bandwidth byte-exactly on every fetch, and the rate for it is unset — the records exist, and nothing has ever been billed against them. The social data API is metered the same way while it is in beta. If either is ever priced it will be a published number with notice, not a line that quietly appears on an invoice.

How you buy it, and how the money moves

Card checkout is being enabled through our payment provider, which acts as merchant of record for card sales: it contracts with you for the sale, takes the payment, assesses and remits the tax, and issues refunds. No card number, security code or expiry date is accepted, transmitted or stored by us at any point in that flow.

Alongside it, and by preference for buyers with procurement, an account can be activated and billed by invoice at the same published rates. Write to billing@roamingproxy.com; we agree the plan and the rate with you in writing before anything is charged, and the invoice is due 30 days from issue unless we agree otherwise. Nothing is charged to anyone who has not agreed a price first.

Refunds, cancellation and the dispute route are set out in full at /refunds. If you think a charge is wrong, write to billing@roamingproxy.com before your bank: we aim to reply within one business day, and a billing error is corrected with a numbered credit note against the invoice in question rather than argued about.

Before either of those, you can try it without paying. Self-serve signup opens a 30-day trial with a ceiling of 1,000 requests counted across every key on the account, and no card is taken for it. Nothing is charged when it ends: the account stops making requests rather than rolling into a paid subscription, so there is no renewal to remember to cancel and the fetch endpoint answers 403 with the code trial_quota_exhausted.

How it is delivered

Delivery is electronic and immediate. There is nothing to ship and nothing to install: you create an account, verify your email address, mint a key and call the API, and the key works on the next request. The verification step is a real gate rather than a formality — an account without a live subscription is refused egress with 403 and the code email_verification_required until it clears. If the mail does not arrive, write to support@roamingproxy.com from the address on the account and we verify it by hand, usually within one business day. That fallback is published in the API's own refusal body, not only here.

Egress is three nodes, one in each region we advertise: us-east, us-west and europe, running on AWS in us-east-1, us-west-2 and eu-west-1 inside our own account, each with a stable Elastic IP. That is the entire fleet, and the number is more useful to you than a map would be. Naming a region selects an exit address; there is no pool sitting behind it to draw from, and the User-Agent presented to the target is the one you sent.

GET /v2/proxy/regions is the live authority on which regions are in service, and region_used in every response tells you which one actually served — a region that fails mid-request is failed over to another rather than failing outright, so read the field instead of assuming. That endpoint needs a key; the plan catalog and the full reference do not, and both are named at the foot of this page.

Who buys it, and who should not

Developers and data teams running collection that repeats. The concrete jobs are price and competitor monitoring, news and content aggregation, collecting public financial documents, and product data extraction where you want the page and intend to parse it yourself. The common shape is a script you run on your own schedule, against public pages and public APIs, from an address that is not your office.

It is the wrong tool for two buyers, and saying so here is cheaper for both of us than saying it after you integrate. If your target refuses datacenter traffic outright, three AWS addresses do not change that answer. If you want the data extracted, ranked or scheduled for you, this is a fetch layer and not a data product.

The limits, with their real numbers

A limit you discover in production is a refund conversation. A limit you read here is a design constraint you can plan around. All of these are values in the code, not aspirations.

GET only, one URL per call

The outbound request is always a GET. No POST to targets, no form submission, no cookies and no session handling — the only header of yours we forward is User-Agent.

A 5 MiB response cap

Larger bodies are refused with 413 and the code response_too_large, checked both against the declared length and again as the body streams, so a lying Content-Length does not get through.

Five redirect hops

Followed one at a time, each re-resolved and re-checked before the next connection is made rather than handed to the HTTP client to chase.

About twelve seconds per attempt

With up to three attempts against an endpoint before the fetch fails over to another region, and no_healthy_endpoints when nothing served. Long-polling a slow target is not what this is for.

Published rate ceilings

120 calls a minute to the fetch endpoint and 300 a minute across the rest of the API, both per account, plus 60 a minute to any single target host and a shared ceiling of 600 a minute to one host across every caller.

Retries that bill once

Send an Idempotency-Key and a retry inside 24 hours replays the stored response with Idempotency-Replayed: true, spending no egress and billing nothing twice. Reusing a key for a different URL or region is refused rather than quietly served. If our own service dies mid-request the key stays reserved for about two minutes and then becomes retryable, and that retry re-executes the fetch rather than replaying it.

Errors are a contract, not a mood

A refusal is two fields, detail and code, and nothing else. The vocabulary is twenty-two codes that are never renamed and never reused, and a test holds the table in the published reference in sync with the constants in the source, so a code you branch on cannot quietly change meaning under you.

The ones you will actually handle: target_not_permitted when policy refuses a URL, unknown_region and region_out_of_service for a region that does not exist or is out of service, no_healthy_endpoints when nothing served, rate_limited and target_rate_limited for the two ceilings above — both carry Retry-After — response_too_large for the size cap, and email_verification_required before an unverified account's first fetch. The full table sits in the reference next to the operation that raises each one.

What we will not sell you, and why

We do not solve CAPTCHAs. If a target answers with an anti-bot challenge or an interstitial, you receive that page as HTML with the target's own status code in the envelope, and what you do next is your decision rather than a product we sell. We run no headless browser and execute no JavaScript, so there is nothing in this path that could complete a challenge even if we wanted to sell it — which we do not, and are not about to.

We do not sell anonymity or block evasion, and we are careful not to imply it. The three egress addresses are AWS addresses with stable Elastic IPs in an account we own, which makes any request you send through us traceable back to us and, through our own logs, to a named account. That is a deliberate property of the design and not something we would trade away. A site that refuses datacenter ranges will refuse ours, and moving between three addresses in the same kind of range does not change that answer.

We withdrew search-engine results instead of faking them. The SERP endpoint answers 503 with a written explanation and the code serp_withdrawn, and it bills nothing, because search engines serve a challenge to datacenter addresses and an honest refusal is worth more to you than an empty result set that looks like a successful call.

The social data API is admitted to by the same rule. A platform ships only if its public API demonstrably answers our datacenter address with no credentials, which is why Bluesky, a fixed allowlist of Mastodon instances and Hacker News are there and Reddit is not. GET /v2/social/platforms returns that list including the exclusions and the reason for each.

The controls that make those refusals mean something

A refusal is only worth reading if something enforces it. These are the controls behind the paragraphs above, and each one is a line of code rather than a policy statement.

Targets are checked after DNS, on every hop

A URL that resolves into private, link-local or cloud-metadata space is refused with 403 and target_not_permitted, as is anything on the operator blocklist. The check runs twice: in the control plane before dispatch, and again on the egress node at connect time, on every redirect hop.

Nodes refuse unsigned callers

Each egress node requires an HMAC signature from our control plane and answers 401 to anything else, so a node cannot be turned into an open proxy by whoever finds its address.

The per-host ceiling is an abuse control

The cap of 60 calls a minute to any one target host exists so that no customer can hammer a third party through us. It protects the sites you fetch, not our margins.

Logs are scoped, and dated to the chargeback window

We record the key prefix, source address, user agent, endpoint, status and timestamp. We do not log the target URL or the response body, including on the egress node. API logs are kept 13 months, which spans the window the card networks allow for a dispute; usage records are kept seven years for invoicing and tax.

Acceptable use is contractual and enforced

The Terms forbid unauthorised access; bypassing authentication, paywalls, rate limits or access controls you are not entitled to bypass; credential stuffing, brute force, malware and denial-of-service; unsolicited bulk messaging; child sexual abuse material and incitement to violence; collecting personal data in breach of data-protection law; reselling raw egress; and opening multiple accounts to take the free allowance repeatedly. Material breach means suspension or termination without refund, and we contact you first where the breach is not causing ongoing harm.

Eligibility, stated rather than screened

You must be 18 or over and must not be located in, or acting for anyone in, a comprehensively sanctioned jurisdiction. That is a contractual restriction backed by suspension, and we do not claim a screening programme we have not built. Data-rights requests are answered within 30 days.

Who sells it, and how to reach us

RoamingProxy is the product; Trade Vault LLC is the company that sells it. Trade Vault LLC, a limited liability company trading as RoamingProxy, is the seller of record on every invoice we issue, the counterparty named in section 1 of our Terms of Service, and the party accountable for everything described on this page.

Five addresses and one number reach us. support@roamingproxy.com for technical questions, failing calls and account access. billing@roamingproxy.com for pricing, invoices and any charge you dispute. abuse@roamingproxy.com for abuse and security reports. legal@roamingproxy.com for the contract. privacy@roamingproxy.com for access, correction and deletion requests. And +1 (888) 527-9275, which is a voicemail box rather than a staffed line: leave your account email address and what went wrong, and we come back to you. There is no live chat widget, no ticket portal and no office you can visit.

Three response commitments are published and there is no fourth. Abuse reports: two business days, from the Terms. Data-rights requests: 30 days, from the Privacy Policy. Manual email verification when the automated mail does not arrive: usually one business day, from the API's own refusal body. Everything else has no published target, and inventing one we do not measure would be worse than admitting there is none.

Check this page against something

Nothing here asks to be taken on trust, and two things can be checked without an account. GET https://api.roamingproxy.com/v2/plans returns the live plan catalog straight out of the billing engine, so the price above can be checked against the system that charges you. The full API reference at https://api.roamingproxy.com/v2/docs is public — the fourteen published operations, the request and response shapes and the whole error table are in it.

The documents that govern the sale — pricing, Terms of Service, Refund and Cancellation Policy, Privacy Policy, the acceptable-use page and the abuse route — are all linked below, from this page rather than only from a footer, so that reading them before you buy is the path of least resistance.

Questions

What exactly am I paying for each month?
Access to the fetch API and the other published operations, from an account you control, with $25.00 a month covering 50,000 requests and $0.50 per 1,000 beyond that. There is no hardware, no licence file and nothing to install. The dashboard shows what has been metered against the account, and an invoice follows the period rather than a surprise.
Can I pay by card, or do I have to talk to somebody?
Card checkout through our payment provider, acting as merchant of record, is being enabled. Alongside it, an account can be activated and invoiced at the same published rates once we have agreed the plan with you in writing. Either way we never see or hold the card: no number, security code or expiry date is accepted, transmitted or stored by us at any point.
What am I charged when a fetch fails?
A billable request is recorded when a fetch is performed. A call we refuse before dispatch — an unknown region, a region out of service, a blocked target, a rate limit — is not a fetch and is not billed. A fetch that reaches the target and returns its 404 or its block page is a delivered fetch and is billed, because it is the work the API sells.
Do you solve CAPTCHAs, or bypass anti-bot challenges?
No, and we will not bundle or resell it either. A challenge page is returned to you as HTML with the target's own status code. We run no headless browser and execute no JavaScript, so nothing in this product could complete a challenge. If your target gates on that, we are the wrong supplier and you should know it now.
Are these residential or mobile addresses?
Neither. Every egress address is an AWS Elastic IP in an account we own, and no upstream provider is integrated behind them. If your target refuses datacenter ranges outright, this product will not reach it, and we would rather you knew that before you paid.
How do I try it before paying?
Create an account and use the 30-day trial, which is capped at 1,000 requests counted across every key on the account. No card is taken. Nothing is charged when it runs out: the account stops making requests rather than rolling into a subscription, and the fetch endpoint answers 403 with the code trial_quota_exhausted.
What happens if I go over the included volume?
Nothing breaks. The allowance is included volume, not a hard cap, so requests keep being served and the extra is rated at the published metered rate. The two ceilings that do refuse you are the rate limits — 120 a minute on the fetch endpoint per account, and 60 a minute to any one target host — and both answer 429 with Retry-After rather than silently dropping the call.

Get a key

Create an account and mint an API key in the dashboard. The full endpoint reference — request shapes, parameters and error codes — is published at https://api.roamingproxy.com/v2/docs.