Authentication

Mobile uses the same two authentication models as residential — pick whichever fits your runtime. The mechanics are identical; only the type segment in the username changes.

Model A — User + password (default)

curl -x http://helo_s1a2b3c4d5e-type-mob-region-us:[e-mail]:7777 \
     https://example.com

The password is the mobile sub-user password. Mobile and residential sub-users have independent passwords even if the names look similar.

Model B — IP whitelist

curl -x http://[e-mail]:7777 \
     https://example.com

To register IPs: Dashboard → Mobile → {Sub-user} → Whitelisted IPs. Up to 50 IPv4 addresses or CIDR ranges per sub-user. Changes take effect within 60 seconds.

Note: residential and mobile maintain separate whitelists. Adding an IP to your residential sub-user does not authorize it for mobile.

Mobile-specific: risk-based KYC

KYC is not required by default. If your account is flagged for a risk review, requests may return the following until verification is completed:

HTTP/1.1 403 Forbidden
X-Helodata-Error-Code: kyc-required

This is the exception, not the norm. See ID verification (KYC).

Choosing between them

The same trade-offs as residential — see Residential authentication. The mobile-specific consideration: if your client is a mobile device or NAT egress that itself uses cellular/dynamic IPs, IP whitelisting is impractical; default to user+password.

Rotating credentials

To rotate a mobile sub-user password:

1. Dashboard → Mobile → {Sub-user} → Reset password.
2. Old password works for 60 seconds, then begins returning 407.
3. Update your deployment.

API

Whitelisted IPs and sub-user credentials are managed via the Whitelists API and Sub-users API. Scope the product parameter to mobile.