Troubleshooting

The problems every integration hits first, in the order you are likely to hit them: a script that cannot connect at all, then one that connects but is slow.

407s and 400s: auth and targeting

These show up before anything reaches the destination, so the fix is in the request you sent.

Authentication and targeting error codes
Status	Code	Cause
407	AVO_AUTH	Wrong username or password, a login that is not 3–32 lowercase letters, digits or underscores, or a call from an IP outside a proxy user's allowlist.
400	AVO_BAD_TARGETING	A typo in a targeting key, an unknown key, a repeated key, or a value in the wrong shape, for example -cc-DE instead of -cc-de.
400	AVO_TARGETING_NOT_SUPPORTED	The key parses but the product does not sell it, for example a state or city key on a product that sells country targeting only.

Targeting keys live inside the username. A client that has a distinct username box and a country box (some anti-detect browsers do) still wants them concatenated: USERNAME-cc-de, one string.
Full grammar and per-product support on the targeting page; every code, with what to do about it, on the error reference.

403s: quota and blocks

The request authenticated fine but was refused anyway.

Quota and destination error codes
Status	Code	Cause
403	AVO_DISABLED	The proxy user is switched off.
403	AVO_QUOTA	The GB balance for that product is used up.
403	AVO_PORT_NOT_ALLOWED	The destination port is not on the allowed list, or it is port 80 on a product that does not carry plain http://.
403	AVO_TARGET_NOT_ALLOWED	The destination is a private, loopback, link-local or cloud-metadata address, or an IPv6 address written as a literal. For an IPv6 destination, use its hostname.

Topping up resumes a quota-blocked proxy user within a couple of seconds, with no restart. See the error reference for the rest of the codes, including the 429 you can hit from opening new connections too fast.

A redirect to https:// on an http:// URL

On residential and mobile, use https:// destinations: a plain http:// request is answered with a redirect to the same address on https://, and a tunnel to port 80 is refused. Premium residential also carries plain http:// destinations.

Request the https:// address instead. A test endpoint that echoes your address works the same over HTTPS, and a client set to follow redirects ends up there by itself.

TLS and certificate errors

Tunnelled HTTPS goes through CONNECT: once the tunnel is open, we relay bytes without decrypting them, so the TLS handshake and the certificate your client sees are exactly what the destination presents. A certificate error, a TLS version mismatch, or a “self-signed certificate” warning is between your client and that destination.

To confirm: try the same request with the proxy removed entirely. If the TLS error persists, the cause is the target site or a corporate network inspecting your own traffic, and the tunnel is not involved.

What affects speed

Rotating pays setup cost every time. A brand-new connection needs a fresh exit address before the first byte moves; a sticky session pays that once and reuses it. See sticky or rotating.
Product matters. Residential and mobile exits sit on different networks and answer at different speeds. Pick the product by what the job needs.
The destination has its own limits. A slow or rate-limiting target answers slowly however fast we relay the bytes; a destination that fails outright answers 502 AVO_NETWORK_ERROR, which is worth a retry with backoff rather than a change to your client.
Concurrency helps up to a point. Opening many connections at once moves more data, but opening brand-new ones faster than you need to only adds setup cost. Reuse connections where your client supports it.

Reading the Live usage tab

Dashboard → Usage → Live shows where your traffic is going right now: bytes per destination host, refreshed every few seconds, over a 15-minute, 1-hour or 24-hour window. It confirms an integration end to end while you build it: fire a request and watch the destination appear, instead of waiting for the daily usage chart to catch up.

Nothing appearing means the request never reached the gateway. Check the auth and targeting table above first.
The destination appears but traffic looks higher than expected: check for a retry loop or a client that is not reusing connections.
The same page from your own code: GET /usage/live on the REST API returns the same numbers as JSON, for a health check in CI or a build step.