Set up your connection

Recommended: the HTTPS proxy

This is the method to use. Because the connection to the proxy is wrapped in TLS, your username and password are encrypted on the way to it, and so is the address of every site you ask for.

Command line:

curl --proxy "https://USERNAME:PASSWORD@proxyserver.xikey.com:8443" https://example.com/

Sites that must NOT go through the proxy

Video is deliberately excluded. It is the one thing this service cannot make smaller — the payload arrives already compressed — so relaying it spends your allowance for no gain. Video providers also refuse to serve a datacentre address: YouTube answers with Sign in to confirm you're not a bot and the video never plays.

A manual proxy setting ignores this list. If you typed a server and port into your settings, everything goes through the proxy and video will fail. Either use the automatic configuration URL below, or add these to your client's bypass list by hand.

Firefox — Settings → Network Settings → No proxy for:

youtube.com, googlevideo.com, ytimg.com, ggpht.com, youtu.be, nflxvideo.net, ttvnw.net

macOS — System Settings → Network → Proxies → Bypass proxy settings for these Hosts & Domains:

*.youtube.com, *.googlevideo.com, *.ytimg.com, *.ggpht.com, *.youtu.be, *.nflxvideo.net, *.ttvnw.net

These hosts are not metered and, once content filtering exists, will not be filtered either. That is the trade being made: your real address, your real country and none of your allowance, in exchange for no policy applied.

Browsers: automatic configuration — use this one

Paste this as the automatic proxy configuration URL — not as a server and port. It is the only setting that applies the bypass list above for you, and the only one that reaches the proxy over TLS.

https://pop1.xikey.com/proxy.pac

The browser prompts for your username and password the first time.

Firefox caches this file. After it changes, open Settings → Network Settings and press Reload, or restart the browser — otherwise you keep the old routing and it looks as though nothing happened.

The certificate

Nothing to install. This point of presence uses a publicly trusted certificate, so your client already recognises it. If you are ever asked to install a certificate or to skip a certificate warning to use this service, refuse and report it.

SOCKS5 — only on a network you trust

SOCKS5 sends your username and password unencrypted. That is how the protocol works (RFC 1929) and there is no setting that fixes it. Every device between you and this server sees the credential in the clear, on every session. Use it only inside a network you already trust, or through a tunnel. Over the public internet, use the HTTPS proxy above instead.

If it does not connect

407 Proxy Authentication Required

The username or password is wrong, or the credential was revoked. Check the console.

403 Forbidden

The destination is refused by policy — private addresses, link-local addresses and outbound mail are never permitted through this service.

curl: (60) SSL certificate problem

For a proxy, trust is set with --proxy-cacert, not --cacert. This is the single most common cause.

400 Bad Request, or the connection hangs

You are probably reaching a CDN rather than this server. Check that the address you configured resolves to the address shown above.

Never work around a certificate warning to make a connection succeed. If verification fails, either the configuration is wrong or something is interfering with the connection, and both are worth knowing about.