---

title: FAQ description: Common questions about GuardProxy — what it can and can't do, billing, and limitations. group: Reference order: 2

Frequently Asked Questions

Does GuardProxy store my API key?

No. Your Authorization header passes through in memory for the duration of the request and is forwarded to the upstream. It is never written to storage or logs. When the response returns, the key is gone.

Do I need to change my code?

Only the URL. Point your existing client at the proxy endpoint instead of the upstream's real URL. The path, query string, headers, and request body all stay the same.

// Before
fetch("https://api.itglue.com/v2/accounts", { headers: { Authorization: "Bearer " + key } });

// After
fetch("https://cust_abc.guardproxy.dev/itglue/v2/accounts", { headers: { Authorization: "Bearer " + key } });

Can GuardProxy block writes on a GraphQL endpoint?

Not selectively — GraphQL sends both queries and mutations as POST to the same endpoint, and GuardProxy filters by HTTP method, not request body. See Limitations for the details and a workaround.

What about APIs that use GET for mutations?

GuardProxy filters by method, not by request semantics, so a GET that mutates data will pass through. See Limitations for guidance.

Does it add latency?

GuardProxy runs on Cloudflare's edge network, so requests are typically routed through a nearby PoP. The added hop is usually negligible. Response bodies stream through — there's no buffering unless the response exceeds the size cap.

What's the request limit?

It depends on your plan: 20,000/mo on Free, 50,000/mo on Pro, and 250,000/mo on Team. It's a hard limit — once you reach it (whether allowed or blocked requests) in a calendar month, further requests return 429 until the next cycle. Upgrade your plan for a higher limit.

How long are block logs retained?

7 days on Free; full history on Pro and Team. Usage counters (allowed vs blocked, per upstream) persist for the current month.

Can I use the same upstream URL for multiple customers?

Yes — each customer configures their own upstreams independently. Tenant isolation is enforced by the customer slug in the subdomain; one customer can never see or route to another's config.

Is there a free tier?

Yes — a perpetual Free plan with 20,000 proxied requests per month and 1 upstream. New accounts also start with a 14-day Pro trial (full Pro features, no credit card), so you can evaluate everything before the trial drops to Free. See pricing for the plan breakdown.

What happens when my trial or subscription ends?

There's no lock-out. When your Pro trial ends, or when you cancel a paid subscription, your account drops to the Free plan — your proxies keep running at Free limits (20,000 requests/mo, 1 upstream), and nothing is deleted. Upgrade again anytime from the billing page to restore higher limits.

If a payment simply fails (card declined), your account enters a past_due grace state and keeps working at your current plan while Polar retries — you won't be downgraded on a transient card failure.

How do I rotate my API key?

The same way you always would, at the vendor. Since GuardProxy never stores the key, just start sending the new key in your client's Authorization header — there's nothing to update on the GuardProxy side.

Something else?

Email support@guardproxy.dev and we'll help.