Developer API Terms

These Developer API Terms apply when you use the Ghostunnel API — the JSON API documented at /docs that our own apps use to sign in, manage devices and connect. They form part of our General Terms of Service, which also apply.

1. Using the API

You may use the API to access your own Ghostunnel account — for example to build a personal client, script your own connections, or integrate Ghostunnel into your own tools. You need a Ghostunnel account, and everything you do through the API counts as use of that account, including its plan limits.

You may not use the API to access other people’s accounts without their permission, or to offer Ghostunnel to others as a product or service without our written agreement.

2. Tokens and credentials

The API uses short-lived access tokens and longer-lived refresh tokens, and our apps use tokens tied to a specific device. Treat every token like a password:

• keep tokens confidential, and don’t embed them in public code or share them;
• store them securely on the device that uses them;
• revoke them if you think they have leaked — the API lets you revoke all of your tokens at once, and signing a device out or changing your password does the same.

You are responsible for activity carried out with your tokens.

3. Rate limits and fair use

The API is rate-limited. Limits currently apply per account (or per IP address before you sign in) for each group of endpoints, and sign-in and sign-up endpoints have stricter limits. Requests over the limit receive an HTTP 429 response. Limits may change as we grow; the response headers tell you how many requests you have left.

Design your client to handle errors and rate limits gracefully — back off and retry rather than retrying in a loop.

4. Restrictions

You may not:

• try to get around rate limits, plan limits or authentication, for example by rotating accounts or IP addresses;
• scrape the API, or use it to collect information about our servers or other users beyond what you need for your own use;
• use the API in a way that breaks our Acceptable Use Policy, or that disrupts or overloads the Service;
• resell, sublicense or wrap the API as your own service;
• suggest that your software is made or endorsed by Ghostunnel, or use our name or logo in it without our permission.

5. Changes and versioning

The API is versioned in its paths (currently /v1). We may add new endpoints and fields at any time — your client should ignore fields it doesn’t recognise. Where reasonably possible we will give advance notice in the API documentation before removing or making incompatible changes to a published version, unless a change is needed urgently for security or legal reasons.

6. Your data

Data you send and receive through the API is handled under our Privacy Policy, in the same way as data from our apps and website. If your software processes other people’s data, you are responsible for doing that lawfully.

7. Suspension and termination

We may limit, suspend or revoke API access — including revoking tokens — if you break these terms, if your use puts the Service or other users at risk, or if we stop offering the API. Where reasonable, we will tell you first.

8. No warranty

The API is provided “as is”, without any promise of availability, uptime or backwards compatibility beyond what is described in section 5. The disclaimers and limitations of liability in our General Terms of Service apply to the API.

9. Contact

Questions about the API: [email protected].