Authentication

Proxy authentication: passwords and SSH signed tokens.

CIFP has two separate authentication layers:

Proxy authentication — clients authenticate to the proxy to be allowed to use it (username + password)
Control plane authentication — authenticating to the CIFP API to manage proxies, secrets, and credentials (API keys or session)

Proxy Credentials (Username + Password)

Every proxy requires connecting clients to authenticate with HTTP Basic proxy authentication (Proxy-Authorization header). You generate credentials on the Credentials tab.

bash

# Generate a credential
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/credentials \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{"description":"my-agent-prod"}'

# {
#   "username": "proxy-abc123-u1a2b3c",
#   "password": "CIFPrand0mGeneratedPassword",   ← only shown once
#   "id": "cred_xxx"
# }

# Use the credential
curl -x https://proxy-abc123.proxy.cifp.vril.dev:3128 \
     -U "proxy-abc123-u1a2b3c:CIFPrand0mGeneratedPassword" \
     https://api.github.com/user

Port Scoping

Each proxy listens on a primary port (3128). The credential can optionally be scoped to specific ports. A port of 0 means "any port" (the default).

bash

# Credential valid only on port 3128
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/credentials \
  -d '{"description":"port-scoped","port":3128}'

Expiry and Rotation

Credentials can have an optional expiresAt date. After expiry, the proxy rejects connections using that credential with 407.

bash

# 30-day credential
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/credentials \
  -d '{"description":"30-day-token","expiresAt":"2026-07-06T00:00:00Z"}'

To rotate: generate a new credential, update your agent's configuration, then revoke the old one.

bash

# Revoke
curl -X DELETE https://cifp.vril.dev/api/proxies/proxy-id/credentials/cred-id \
  -H "Authorization: Bearer cifp_your_api_key"

Control Plane API Keys

To authenticate your scripts and CI pipelines to the CIFP API, create an API key from the dashboard or API. Keys are prefixed cifp_ and scoped to specific operations.

bash

# Create an API key
curl -X POST https://cifp.vril.dev/api/keys \
  -H "Authorization: Bearer cifp_existing_key_or_use_session" \
  -d '{
    "name": "ci-pipeline",
    "scopes": ["proxies:read", "secrets:write"]
  }'

# Response includes the raw key — store it securely
# { "key": "cifp_abc123...", "id": "key_xxx", ... }

bash

# Use the key in API requests
curl https://cifp.vril.dev/api/proxies \
  -H "Authorization: Bearer cifp_your_api_key"

Available Scopes

Scope	Allows
proxies:read	List and get proxy details
proxies:write	Create, update, and delete proxies
secrets:read	List secret names and metadata (not values)
secrets:write	Create, update, and delete secrets
credentials:read	List credential metadata
credentials:write	Generate and revoke credentials
rules:read	List firewall rules
rules:write	Create, update, and delete rules
logs:read	Query access logs
keys:read	List API keys
keys:write	Create and revoke API keys