> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zapier.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What is the Proxy API?

> How Proxy API routes your HTTP requests through Zapier with credential injection, and when it applies.

Proxy API is Zapier's secure HTTP proxy for outbound API calls. It injects stored Zapier connection credentials into requests before forwarding them to the target API. Available on all Zapier plans.

Key facts:

* Gives access to every endpoint on a third-party API, not only pre-built Zapier actions.
* Works across 9,000+ apps Zapier connects to.
* Resolves the correct auth method per app (OAuth 2.0, API key, Basic auth, custom token exchange, and others).
* Automatically refreshes expired OAuth tokens and retries once.
* Streams responses back unchanged.
* Blocks requests to internal/private network addresses (SSRF protection).
* Used by: Code by Zapier, Zapier SDK (beta), Custom actions, MCP code actions (beta), Sidekick (beta).
* Enterprise admins can block Proxy API requests account-wide or per-app.
* Error codes from Proxy API: 400 (bad request), 401 (unauthorized), 403 (admin blocked), 429 (rate limited), 500 (internal error), 502 (bad gateway), 504 (gateway timeout). Any other status code comes from the target API.
* Rate limits are being finalized (Oct 2026).

Proxy API is a secure pass-through for outbound HTTP calls. Your code or agent sends an HTTP request to a third-party API, and Zapier injects the stored credentials before forwarding it. The response comes back unchanged.

You get direct access to every endpoint on the third-party API, not only the operations Zapier has pre-built as [actions](https://docs.zapier.com/integrations/quickstart/glossary.md). This works across any of the 9,000+ apps Zapier connects to, without managing credentials. Proxy API is available on all plans.

## How it works

```mermaid theme={null}
sequenceDiagram
    participant Code as Your code
    participant Proxy as Zapier Proxy API
    participant App as Third-party API

    Code->>Proxy: HTTP request (no credentials)
    Note over Proxy: Validate request and<br/>inject stored credentials
    Proxy->>App: Authenticated request
    App-->>Proxy: Response
    Proxy-->>Code: Response (unchanged)
```

1. You send an HTTP request to Proxy API with the target URL and a [connection](https://help.zapier.com/hc/en-us/articles/8496181725453) to the target app. The connection holds the credentials Proxy API needs to authenticate the request.
2. Proxy API validates the request and checks admin controls.
3. Proxy API resolves the connection's auth type (OAuth, API key, custom header, or other), injects the credentials, and forwards the authenticated request.
4. The third-party API responds, and Proxy API streams the response back unchanged. If the API returns a `401`, Proxy API automatically refreshes the credential and retries once before returning an error.

## Why use Proxy API

> **Full API access beyond pre-built actions**
>
> Pre-built actions cover the operations Zapier has defined for each app. Proxy API gives you access to every endpoint the third-party API supports. If the API has an endpoint for it, you can call it.

> **Works with how AI agents build**
>
> Third-party API documentation is widely available in LLM training data. AI agents can generate raw HTTP calls to well-documented APIs more easily than they can navigate action-based tooling. Proxy API turns those generated calls into authenticated requests automatically.

> **Exact control over requests**
>
> You choose the URL, method, headers, and body. Build multi-step API sequences, add conditional logic, or transform data in your own code while Zapier handles authentication.

> **No credential management**
>
> Your code never handles raw tokens, API keys, or secrets. Proxy API reads the credentials from the user's Zapier connection and injects them at request time. You reference a `connection_id`, not a credential.

> **Automatic token refresh**
>
> If a stored OAuth token has expired, Proxy API refreshes it and retries the request automatically. Your code does not need retry logic for expired credentials.

> **Auth-type abstraction**
>
> Each of the 9,000+ supported apps has its own auth method: OAuth 2.0, API key in a header, API key in a query parameter, Basic auth, custom token exchange, and others. Proxy API resolves the correct method per app. Your code sends the same request shape regardless of how the target API authenticates.

> **Streamed responses**
>
> Proxy API streams the third-party API's response back to your code as it arrives, rather than buffering the full body. This keeps memory usage low and reduces time-to-first-byte for large payloads.

> **Built-in security**
>
> Proxy API validates every request before forwarding it. Requests to internal or private network addresses are blocked (server-side request forgery protection). Credentials are never exposed to your code or logged in plain text.

## Features that use Proxy API

* [Code by Zapier](https://help.zapier.com/hc/en-us/articles/44955499643917)
* [Zapier SDK](https://docs.zapier.com/sdk/quickstart.md) (beta)
* [Custom actions](https://help.zapier.com/hc/en-us/articles/16276574838925)
* [MCP code actions](https://docs.zapier.com/mcp/overview/how-tools-work.md) (beta, private early access)
* [Sidekick](https://help.zapier.com/hc/en-us/articles/45884588103309) (beta)

## Enterprise governance

Enterprise admins get [additional controls](https://help.zapier.com/hc/en-us/articles/PLACEHOLDER-TECHWR-6817):

* **Account-wide**: Allow or block all Proxy API requests for the entire account.
* **Per-app**: Allow or restrict Proxy API requests for a specific app, scoped to a member, team, or everyone.

## Errors

If your request fails, you may receive one of the following status codes from Proxy API.

| Status code | Meaning | Notes |
| - | - | - |
| `400` | Bad request | The request is malformed or missing a required field. Check the request body and headers. |
| `401` | Unauthorized | The connection credentials are invalid or expired. Reconnect the app in Zapier. |
| `403` | Forbidden | An admin has blocked Proxy API requests for this account or app. Contact your Zapier admin. |
| `429` | Rate limited | You have exceeded the rate limit. Wait and retry with exponential backoff. |
| `500` | Internal server error | An unexpected error occurred. Retry the request. |
| `502` | Bad gateway | The target API returned an invalid response. Retry the request. |
| `504` | Gateway timeout | The target API did not respond in time. Retry the request. |

## Limits

> [!NOTE]
>
> Rate limit details are being finalized. This section will be updated when the limits are confirmed.

## Related

> **[Manage Proxy API for Enterprise](https://help.zapier.com/hc/en-us/articles/PLACEHOLDER-TECHWR-6817)**
>
> Admin setup for account-wide and per-app controls.

> **[Troubleshoot connection errors](https://help.zapier.com/hc/en-us/articles/8496037735437)**
>
> Expired or revoked connections are handled by Zapier's connection layer, not Proxy API.