Plugging a US Mobile Proxy Into requests, Playwright and curl

A line from Mobile Proxies US is an authenticated proxy with two listeners: an HTTP(S) port and a SOCKS5 port. Any client that can speak either protocol can use it. This page gives the exact configuration for the four clients developers ask about most, with the small details that cause the common failures: wrong scheme, DNS resolved locally, credentials with reserved characters, and headless browsers that silently ignore proxy auth.

The two endpoints and when to use each

The HTTP endpoint accepts CONNECT for HTTPS and plain forwarding for HTTP. It is the simplest to configure and works everywhere. The SOCKS5 endpoint carries any TCP stream, and UDP too where the line's server supports it (capabilities.socks_udp in the list call), which matters for QUIC, WebRTC and some mobile SDKs. Both share the same username and password and the same exit IP; they are two doors into one line.

Rule of thumb: HTTP for browsers and ordinary HTTP clients, SOCKS5 when the traffic is not HTTP or when you want DNS resolved on the carrier side. With SOCKS5 use the socks5h scheme (the h stands for hostname) so the proxy, not your machine, resolves names. Otherwise the destination may see a US carrier address while your local resolver leaks the lookup.

curl

curl is the fastest way to confirm a line works before touching any code. Two commands: one through HTTP, one through SOCKS5. Both should print a carrier address, and a lookup of that address should show AS20057 for AT&T, AS21928 for T-Mobile or AS22394 for Verizon.

If the password contains characters like @ or : or /, percent-encode them in the URL form, or pass credentials with -U instead of embedding them. A 407 means the proxy rejected the credentials; a connection refused means wrong host or port; a timeout followed by success means you caught a rotation in progress.

# HTTP endpoint
curl -s -x http://USER:PASS@HOST:HTTP_PORT https://api.ipify.org
# SOCKS5 with remote DNS
curl -s -x socks5h://USER:PASS@HOST:SOCKS_PORT https://api.ipify.org
# credentials as a separate flag
curl -s -x HOST:HTTP_PORT -U 'USER:PASS' https://api.ipify.org

Python requests

requests takes a proxies dict keyed by scheme. Use the same proxy for both http and https keys. For SOCKS5 install the socks extra and use socks5h. Build a Session so the proxy and connection pool are reused across calls; the carrier address is per line, not per connection, so pooling costs nothing in identity terms.

Set a timeout on every call. A mobile link under rotation or a weak cell will stall rather than refuse, and a client with no timeout hangs forever.

import requests
PROXY = "socks5h://USER:PASS@HOST:SOCKS_PORT"
s = requests.Session()
s.proxies = {"http": PROXY, "https": PROXY}
print(s.get("https://api.ipify.org", timeout=15).text)
# pip install 'requests[socks]' for the socks5h scheme

Playwright

Playwright takes the proxy at browser launch (or per context in recent versions). Pass server, username and password separately; do not embed credentials in the server string, Chromium ignores them there. Use the HTTP endpoint. SOCKS5 with authentication is not supported by Chromium, so for SOCKS use a local xray or similar forwarder and point Playwright at that.

Create one browser context per line if you run several lines in one process. Contexts isolate cookies and storage, and each can have its own proxy, so one Playwright process can drive one Chicago line and one Miami line without mixing sessions.

# Python
from playwright.sync_api import sync_playwright
with sync_playwright() as p:
    b = p.chromium.launch(proxy={
        "server": "http://HOST:HTTP_PORT",
        "username": "USER", "password": "PASS"})
    page = b.new_page()
    page.goto("https://api.ipify.org")
    print(page.inner_text("body"))
// Node
const browser = await chromium.launch({ proxy: {
  server: 'http://HOST:HTTP_PORT',
  username: 'USER', password: 'PASS' } });

Puppeteer and Selenium

Puppeteer takes --proxy-server as a launch argument and then needs page.authenticate for the credentials; without it every request returns a 407 that looks like a blank page. Selenium with Chrome has the same shape: proxy flag at launch, credentials either via an extension or by running a local forwarder that adds them. The forwarder route (xray, or a small local proxy that holds the credentials) is the most reliable across driver versions.

Firefox-based drivers handle proxy auth dialogs differently and are not worth the trouble in headless runs. Pick Chromium and the launch-plus-authenticate pattern.

const browser = await puppeteer.launch({
  args: ['--proxy-server=http://HOST:HTTP_PORT']
});
const page = await browser.newPage();
await page.authenticate({ username: 'USER', password: 'PASS' });
await page.goto('https://api.ipify.org');

Verifying the exit and avoiding leaks

Three checks after wiring any client. First, the echoed address is a carrier address (ASN lookup). Second, DNS is resolved remotely: a DNS leak test page should show carrier or upstream resolvers, not your ISP. Third, for browsers, WebRTC is either disabled or going through the proxy; Chromium's --force-webrtc-ip-handling-policy flag or a profile setting handles this.

Keep the credentials in environment variables or a secret manager and read host, http_port, socket_port and authentication_user from GET /proxies/my. The licence uuid is the stable handle; the exit IP is not, so never hard-code it as an allow-list entry anywhere.

Reading the settings from the API instead of typing them

Every value the examples above show in capitals comes from one call. GET /proxies/my with your key in the x-api-key header returns host, http_port, socket_port and authentication_user for each line, the last one as a single username:password string. Split it on the first colon only, because a password can contain one. Build the proxy URL in one function and let every client in the project call that function, so a change of login or a move to another metro is one restart and not a search through config files.

A move keeps the licence uuid, the login and the remaining term, but it can change the host and the ports, because the line lands on another server. Re-read the list after a move. The same list says whether this line's server carries UDP over SOCKS5, in capabilities.socks_udp, and whether it offers VLESS, in vless_link, which is null when it does not. Check those two before you build a test that depends on either one.

import os, requests
from urllib.parse import quote
BASE = "https://cp.mobileproxiesus.com/backend/api_v1"
H = {"x-api-key": os.environ["MPUS_API_KEY"]}
def proxy_url(uuid, scheme="http"):
    lines = requests.get(f"{BASE}/proxies/my", headers=H, timeout=15).json()["proxyList"]
    line = next(l for l in lines if l["uuid"] == uuid)
    user, password = line["authentication_user"].split(":", 1)
    port = line["http_port"] if scheme == "http" else line["socket_port"]
    return f"{scheme}://{quote(user)}:{quote(password, safe=str())}@{line['host']}:{port}"
print(proxy_url(os.environ["LICENCE_UUID"], "socks5h"))

Frequently asked