Skip to main content
Proxy API is a secure pass-through for outbound HTTP calls. Your code or agent sends an HTTP request to a third-party API, and Zapier injects the stored credentials before forwarding it. The response comes back unchanged. You get direct access to every endpoint on the third-party API, not only the operations Zapier has pre-built as actions. This works across any of the 9,000+ apps Zapier connects to, without managing credentials. Proxy API is available on all plans.

​
How it works

  1. You send an HTTP request to Proxy API with the target URL and a connection to the target app. The connection holds the credentials Proxy API needs to authenticate the request.
  2. Proxy API validates the request and checks admin controls.
  3. Proxy API resolves the connection’s auth type (OAuth, API key, custom header, or other), injects the credentials, and forwards the authenticated request.
  4. The third-party API responds, and Proxy API streams the response back unchanged. If the API returns a 401, Proxy API automatically refreshes the credential and retries once before returning an error.

​
Why use Proxy API

Pre-built actions cover the operations Zapier has defined for each app. Proxy API gives you access to every endpoint the third-party API supports. If the API has an endpoint for it, you can call it.
Third-party API documentation is widely available in LLM training data. AI agents can generate raw HTTP calls to well-documented APIs more easily than they can navigate action-based tooling. Proxy API turns those generated calls into authenticated requests automatically.
You choose the URL, method, headers, and body. Build multi-step API sequences, add conditional logic, or transform data in your own code while Zapier handles authentication.
Your code never handles raw tokens, API keys, or secrets. Proxy API reads the credentials from the user’s Zapier connection and injects them at request time. You reference a connection_id, not a credential.
If a stored OAuth token has expired, Proxy API refreshes it and retries the request automatically. Your code does not need retry logic for expired credentials.
Each of the 9,000+ supported apps has its own auth method: OAuth 2.0, API key in a header, API key in a query parameter, Basic auth, custom token exchange, and others. Proxy API resolves the correct method per app. Your code sends the same request shape regardless of how the target API authenticates.
Proxy API streams the third-party API’s response back to your code as it arrives, rather than buffering the full body. This keeps memory usage low and reduces time-to-first-byte for large payloads.
Proxy API validates every request before forwarding it. Requests to internal or private network addresses are blocked (server-side request forgery protection). Credentials are never exposed to your code or logged in plain text.

​
Features that use Proxy API

​
Enterprise governance

Enterprise admins get additional controls:
  • Account-wide: Allow or block all Proxy API requests for the entire account.
  • Per-app: Allow or restrict Proxy API requests for a specific app, scoped to a member, team, or everyone.

​
Errors

If your request fails, you may receive one of the following status codes from Proxy API.

​
Limits

Rate limit details are being finalized. This section will be updated when the limits are confirmed.

Manage Proxy API for Enterprise

Troubleshoot connection errors

Last modified on October 27, 2026