# Proxy Port: Targeting and Sessions in the Username > Source: > Published: 2026-09-24 15:16:40+00:00 ## What's New One missing letter is all it takes. Type `-contry-de` into a proxy username and the typo sits in plain sight, looking exactly like a working option. The FourA proxy port answers that one with a 400 that lists every key it knows. That's a small detail of a product that [left beta on September 15](https://foura.ai/blog/foura-digest-2026-09-18): a [proxy URL at our exits](https://foura.ai/proxy) for any client that takes one (a browser, a download tool, the scraper you already run), with no API call to write. You create a proxy user in the Dashboard, paste the string, and tunnels and traffic count against your plan the same way API requests do. Here's the whole grammar, and why each rule in it is there. ## How It Works The port lives at `proxy.foura.ai:34004` and speaks HTTP CONNECT with Basic authentication, to targets on ports 443 and 80. Credentials are proxy users, apart from your API key on purpose: a proxy handshake travels in the clear, and a proxy user can get a new password without anyone touching your API integration. Everything after the credential is a list of `-key-value` pairs, in any order: ``` # Shared network, a German address, one sticky session for this job curl -x "http://USERNAME-country-de-session-job42:PASSWORD@proxy.foura.ai:34004" \ https://example.com # Premium network, an Android address in Germany, held 30 minutes curl -x "http://USERNAME-network-premium-country-de-os-android-session-s1-lifetime-30:PASSWORD@proxy.foura.ai:34004" \ https://example.com ``` Shared is FourA's own exits: the default, and included in your plan. Premium is home addresses, drawn from your plan's premium traffic plus any you bought. On the shared network, `-fallback-premium` lets a connection move to a premium exit when the shared one can't carry it. It's off unless you ask, and it only fires while premium allowance remains. Arming it by default would mean deciding, on your behalf, to spend that allowance. Country is repeatable, so `-country-de-country-fr` is a two-country scope. Region, city, network by AS number, device (`windows`, `android`, `ios`, `mac`) and `lifetime` (3 to 1440 minutes) are premium only. Ask for a city on the shared network and you get a 400 rather than a best effort. Shared is chosen by country and nothing finer, because a city filter that mostly can't be honoured is worse than no filter at all. `-session-` (1 to 32 letters, digits or underscores) makes connections sticky: every connection carrying that name shares an address. On shared, the address holds on a sliding ten-minute window, so it lasts as long as you keep using it. On premium it holds for the `lifetime` you set, or the network's default. Leave the session out and each connection leaves from a new address. Then there are saved defaults. Targeting saved on a proxy user in the Dashboard applies to every connection it makes, so the string can shrink to the bare credential. The username still wins for its own connection, and `any` takes a saved value back: `-city-any` asks a key that remembers Munich for the whole of Germany. Clients that can put headers on a CONNECT (curl can, with `--proxy-header`) may send the same options as `X-Foura-Country`, `X-Foura-Session` and the rest, and a header beats the username. ## Impact Most of this shows up as questions you no longer have to ask. **Why was I refused?** Every refusal after your credentials are checked carries an `X-Foura-Error` header with a one-line reason. A 400 names the option and the values it accepts. A 429 says which of your plan's numbers you reached: tunnels open at once, tunnel openings a minute, or standard traffic for the billing period. **Whose allowance is it?** The account's. Tunnels and openings are counted for the account rather than per proxy user, so a second credential doesn't buy a second allowance. Bytes count toward your plan's bandwidth, and premium bytes toward your premium allowance inside that total, never added to it. On a plan sold by credits the port has its own included gigabytes, which the Billing page tops up. Nothing is counted when no tunnel opens. **Who owns the credential?** It can be an organization now, so a company's downloader doesn't stop the day one person leaves. Members use it and read its password; admins and owners rotate, disable or re-target it; only the owner moves it out. **What did it do?** Flip the Product switch on Overview, Metrics or Activity to Proxy: tunnels in the same outcome classes as your API requests, how many are open right now, setup time and traffic, split by proxy user, target, exit country or client IP. A session that already has its address usually connects in well under a second. But the port is a pipe, and that's the trade-off. Your client talks to the site through the tunnel, so the unblocker, your [validate rules](https://foura.ai/blog/validate-decides-success) and browser-based challenge solving aren't in that path. It meters bytes, too: a refusal page that comes down an open tunnel is bytes like any other, where on the API a request that doesn't succeed isn't billed. Move bytes through the port; send the pages that fight back to the API. ## For Power Users Once the premium allowance is spent, the three routes onto that network get three different answers, on purpose. A connection that names `-network-premium` is refused with a 403 that says so, because a caller quietly served from somewhere else would keep asking, then hunt the bill for a premium line that never appears. The fallback simply isn't taken, and a premium default saved on the proxy user drops to the shared network, so the tunnel still opens. Neither of those chose to spend on that connection. Three combinations are refused outright rather than half honoured: finer targeting on the shared network, `-fallback-premium` together with `-network-premium`, and finer targeting while a fallback is armed. The port speaks CONNECT only, so a client that forwards a plain `http://` request instead of tunnelling it gets 405 (curl tunnels it with `--proxytunnel`). And a browser driven through the port should always carry a session name, since one page load opens dozens of connections. Several workers, each on its own address? Give each one its own session name: ``` python import requests TEMPLATE = "http://USERNAME-country-de-session-{name}:PASSWORD@proxy.foura.ai:34004" def worker_session(name): proxy = TEMPLATE.format(name=name) s = requests.Session() s.proxies = {"http": proxy, "https": proxy} return s workers = [worker_session(f"w{i}") for i in range(4)] print(workers[0].get("https://example.com").status_code) ``` The Dashboard does the same at scale: set Sticky, pick how many, and the Connection string tab lists one line per address, as a URL or as `host:port:user:pass` for proxy managers. Puzzled by a refusal? Add `-sv` to the curl call and pipe `2>&1 | grep -i x-foura-error`. Every option is in the [proxy port reference](https://foura.ai/docs/api/proxy-port), and the Dashboard side in [Proxy Users](https://foura.ai/docs/dashboard/proxy). ## What's Next The first client we built on proxy users is our own. The [FourA Chrome extension](https://foura.ai/extension) sends your browser through one of them: choose the network and country, flip the switch, and a status line shows the address sites see. It's a beta, not in the Chrome Web Store, installed from Tools in the Dashboard in developer mode. Further out, [organization billing](https://updates.foura.ai) is on the public roadmap, which matters here because an organization's proxy user bills whoever owns that organization today. A proxy URL is the oldest integration contract there is, and every tool you own already speaks it. The part worth getting right was never the tunnel. It's what the string in front of it is allowed to mean, and what happens when you get it wrong.