Post Data Formatting

To ensure proper validation and optimal fraud detection, your API requests must follow the correct formatting for each field. Below is a detailed explanation of the available parameters.

The vpn_check and advanced parameters are available exclusively to premium plan users. For free users, these parameters will be ignored.

🔹POST Body Parameters#

🔹Parameters length#

The vpn_check and advanced parameters are available exclusively to premium plan users. For free users, these parameters will be ignored.

🔹IP Handling#

When using services like Cloudflare, Nginx, or reverse proxies, the incoming IP address may be masked. Always extract the real IP from trusted headers.

🔹Warning#

If you send Cloudflare’s IP instead of the real visitor’s, OnSefy may incorrectly label the request as high-risk or invalid.

🔹Example: Get Real IP Behind Cloudflare#

Node.js (Express):

const realIp = req.headers['cf-connecting-ip'] || req.headers['x-forwarded-for'] || req.ip;

PHP:

$ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? 
      $_SERVER['HTTP_X_FORWARDED_FOR'] ?? 
      $_SERVER['REMOTE_ADDR'];

Python (FastAPI/Flask):

ip = request.headers.get('cf-connecting-ip') or \
     request.headers.get('x-forwarded-for') or \
     request.remote_addr

🔹User Agent Handling#

The user_agent field should contain the raw User-Agent string from the client’s request header. Do not parse or alter it.

🔹Example: Get User Agent#

Node.js:

const userAgent = req.headers['user-agent'];

PHP:

$userAgent = $_SERVER['HTTP_USER_AGENT'];

Python (FastAPI):

user_agent = request.headers.get('user-agent')

🔹Example Valid Payload#

{
  "phone": "+14155552671",
  "email": "john.doe@example.com",
  "ip": "49.36.241.41",
  "name": "John Doe",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
}

🔹Tips for Formatting#

• ✅ Make sure all string fields are UTF-8 encoded
• ✅ Omit optional fields if not used
• 🚫 Do not send empty strings ("") — they may be rejected
• 📏 Email and name fields should be trimmed to avoid trailing whitespace
• 🕵️ User agent should be the exact string received from the browser or app