Windscribe’s VPN API lets AI agents buy a WireGuard tunnel with USDC, no account needed

Windscribe now sells VPN access through an API that charges a WireGuard public key instead of an account, so an AI agent, script or device can buy and manage a connection on its own. The company’s VPN API page lists one to seven months at US$9 a month, or 12 months for US$69, paid in USDC on the Base network through the x402 payment standard.

Windscribe pitches it at agents that act on the open web for you. It names four jobs: browsing privately behind a Windscribe IP address, checking local prices and search results from another country, putting robots, edge devices and hotel Wi-Fi inside an encrypted tunnel, and giving each customer or job its own key and term. Below is how it works end to end, one step per diagram.

No account, just a key

The API never asks for an email, password, card or session. The agent generates a WireGuard key pair on its own machine, and the public key is the whole identity. Windscribe says the private key never leaves that machine and signs every request that manages the connection, so it’s as sensitive as the connection itself.

Buying doesn’t need a signature, so a plain x402 client can pay for a key. Everything else does. Windscribe’s llms.txt summary says every other call carries an HTTP Message Signature made with the WireGuard private key, a scheme it calls wg-xeddsa-v1. Because anyone can pay for any key, the purchase response includes the preshared key, the shared secret that goes into the tunnel config, only when the request is signed by that key. A key already used by a Windscribe account or a partner is refused with a wireguard_key_exists error before any money moves.

Step 1: ask for a term

The agent sends POST /vpn/wireguard with its public key and a number of months. With no payment attached, the API answers HTTP 402 Payment Required and puts the x402 payment details in a PAYMENT-REQUIRED header and in the body. At the time of writing, a one-month quote asks for 9.00 USDC on Base mainnet and gives the agent 60 seconds to pay.

A GET /vpn call lists the prices, the payment network and token, and whether purchasing is currently available. An unsigned quote only returns the price. A quote signed with the key also checks that the key can buy that term now, so errors such as wireguard_key_exists arrive before the payer signs anything.

Step 2: pay and retry

The agent builds an x402 v2 payment for the single option in the quote: the “exact” scheme, using an EIP-3009 transferWithAuthorization, a signed permission to move a set amount of USDC, signed by the paying wallet. It sends the identical request again with the base64 payload in a PAYMENT-SIGNATURE header, inside the 60-second window. Windscribe says any x402 v2 client can do this without custom code.

Windscribe says it checks the authorisation with Coinbase’s x402 facilitator, confirms the key can still be bought, then settles on Base. Only a successful settlement creates, extends or reactivates access. The reply is HTTP 201 with the entitlement, its expiry and the values for the config’s [Interface] section, and the settlement receipt rides in a PAYMENT-RESPONSE header. Retrying the same PAYMENT-SIGNATURE never pays twice: a settled payment returns the same entitlement.

Step 3: pick an exit and connect

Next the agent signs a GET to /vpn/wireguard/locations. It needs an active entitlement, and it lists Windscribe’s premium WireGuard locations, not static-IP servers. Each location holds groups, one per city, with a WireGuard public key shared by the group’s nodes. Each node carries a health number from 0 to 100, its current load as a percentage of capacity, and lower is better.

The agent then fills in a standard WireGuard config. This is Windscribe’s template, with the angle-bracket values coming from the purchase and locations responses:

[Interface]
PrivateKey = <your WireGuard private key>
Address = <wireguard.address>, <wireguard.address_v6>
DNS = <wireguard.dns>

[Peer]
PublicKey = <locations[].groups[].wg_pubkey>
PresharedKey = <psk>
AllowedIPs = <wireguard.allowed_ips>
Endpoint = <locations[].groups[].nodes[].ip>:<wireguard.endpoint_port>
PersistentKeepalive = 25

Bring the tunnel up with wg-quick up ./windscribe.conf or any other WireGuard client. Windscribe publishes a reference signer, sign_request.py, that needs Python 3.10 or newer and the XEdDSA package. It prints the signing headers as JSON and doesn’t send the private key anywhere.

Filter DNS per key

Each key has eight ROBERT filter lists, ROBERT being the name Windscribe uses for its DNS blocking: Malware (including phishing and botnet servers), Ads + Trackers, Social Networks, Porn, Gambling, Clickbait, Crypto and Other VPNs. New keys start with only Malware on. PUT /vpn/wireguard/settings replaces the list, for example {"robert": ["malware","ads"]}, and an empty list switches filtering off.

Windscribe’s pitch is that an agent that follows a bad link or an injected instruction still can’t resolve known malware, phishing or botnet domains. Two limits apply. Filtering only covers DNS sent to Windscribe’s resolver, the address in the wireguard.dns field, and custom domain rules aren’t supported.

What it costs

Windscribe prices time, not data. One to seven months cost US$9 a month, 12 months cost US$69, and terms of 8 to 11 months aren’t offered. The page puts the 12-month saving at US$39. At most 12 months can be prepaid, and buying again with the same key adds time from whichever is later, now or the current expiry.

Term	Price in USDC
1 month	US$9
2 months	US$18
3 months	US$27
4 months	US$36
5 months	US$45
6 months	US$54
7 months	US$63
12 months	US$69

Months are calendar months, and access ends exactly at the expiry time with no grace period. It’s a one-time settlement with no subscription and no automatic renewal. Windscribe says payments are final: there are no automated refunds, and revoking a key forfeits the remaining time.

Renew, rotate or revoke

The same private key runs the rest of the lifecycle. A signed PUT to /vpn/wireguard buys more time for the signing key. A signed POST to /vpn/wireguard/rotate moves the paid time to a new key with a new preshared key, and the old key stops working and its tunnels end. A signed DELETE revokes access immediately, and buying time again reactivates the key with a fresh preshared key.

The signatures are strict. Each lasts at most 300 seconds, carries a single-use random nonce and allows 60 seconds of clock skew, so an agent with a wrong clock gets a signature_time_invalid error. Windscribe warns that whoever holds the private key, or a config containing it, can change settings, revoke the access or move the paid time to another key, so a leaked config means rotating at once.

What Windscribe stores

Windscribe says it stores the public key, the generated preshared key, the expiry, the ROBERT selection and, for each payment, its product details, state and settlement transaction hash. It says it doesn’t store the paying wallet address, payment signatures or request signatures. The settlement itself is public on Base and names the paying wallet, so the stored hash links the key to that wallet. Windscribe’s llms.txt tells buyers to pay from a wallet they’re comfortable linking to the purchase.

What the docs don’t list, and where to start

The page, llms.txt and the OpenAPI spec list no data cap, rate limit, device limit or server count. The locations list is only returned to a key that has paid.

Windscribe’s page offers this prompt to hand to an agent:

Read https://windscribe.com/vpn-api/llms.txt.
Create a WireGuard key pair on this machine, buy one month of Windscribe VPN access for it with x402, turn on malware and ad blocking, then write a wg-quick config for the closest location. Keep the private key on this machine.

The pages to keep are the VPN API page, the llms.txt summary, the OpenAPI 3.1 spec and the reference signer. The base URL is https://api.windscribe.com/vpn.