---

title: Proxy URLs description: How the GuardProxy proxy URL is structured — customer slug, upstream slug, and the forwarded path. group: Concepts order: 2

Proxy URLs

The URL is the only thing that changes when you route a request through GuardProxy. Everything else — the API key, the auth header, query params, request body — stays exactly as you'd send it to the real API.

URL shape

https://{customer_slug}.{base_domain}/{upstream_slug}/{original_path_and_query}
       └────────────┘ └──────────┘ └──────┘   └────────────────────────────┘
         subdomain     zone apex   upstream   the path the upstream expects

Concretely, to call GET https://api.itglue.com/v2/accounts through the proxy:

Real API:    https://api.itglue.com/v2/accounts
Proxy:       https://cust_abc.guardproxy.dev/itglue/v2/accounts
                                     │            │
                                     │            └── same as the real path
                                     └── the upstream slug the customer configured

The two slugs

• Customer slug — comes from the subdomain (cust_abc from cust_abc.guardproxy.dev). It identifies your account and isolates your config from every other customer's.
• Upstream slug — the first path segment. Everything after it is forwarded verbatim to the upstream, including the query string.

Both slugs are lowercase, [a-z0-9-], 1–32 characters.

Reserved subdomains

These names are rejected as customer slugs and can't be used in the subdomain position:

• app, www, api, dashboard, status, docs

This keeps them free for the product itself.

Always use the proxy_endpoint

You usually shouldn't hardcode or guess proxy URLs. Each upstream has a canonical proxy_endpoint returned by the dashboard API — that's the source of truth:

{
  "slug": "itglue",
  "proxy_endpoint": "https://cust_abc.guardproxy.dev/itglue"
}

Append the upstream path you want to call to that base. See Managing Upstreams for the API reference.

What you send

Nothing changes about your request except the host and the leading upstream segment:

// Before (direct, full access):
await fetch("https://api.itglue.com/v2/accounts", {
  headers: { Authorization: "Bearer " + apiKey },
});

// After (read-only via GuardProxy):
await fetch("https://cust_abc.guardproxy.dev/itglue/v2/accounts", {
  headers: { Authorization: "Bearer " + apiKey }, // same key, same header
});