The 15 minutes before a drop: a checklist of proxy checks

2026-10-15 · Bazyl

This is the checklist I'd run 15 minutes before any drop, in order, with a script at the end that does the two checks people skip. The mistake it exists to stop is testing proxies in the first minute of the drop, when a fresh string can still be answering 407 and there is no time left to fix anything.

Ten items. Most take thirty seconds.

1. Balance

DM the Basil bot /usage on Discord: your balance and a 24-hour usage chart come back in one message. Or from a script, GET https://api.basilproxies.com/api/v1/balance with Authorization: Bearer $BASIL_API_KEY, a key you create under Tools → API in the dashboard. The secret is shown once, at most two keys are active per account, and the limit is 60 requests a minute.

Pay as you go never expires, so a balance bought last month is still there. Check the number, not your memory of it.

2. Fresh strings, one session id per task

Generate the strings for this drop today, not from last week's file. Every sticky string gets its own -session- id, eight lowercase letters or digits, and every task gets its own string. Two tasks on one id are one person to a queue.

The dashboard writes up to 100,000 lines per generation, each with its own id. Fifty tasks is fifty lines. The Pokémon Center walkthrough runs a whole drop on strings built this way.

3. Test brand-new credentials a minute ahead

If the credential pair is new, it can answer 407 Proxy Authentication Required for about a minute while the gateway picks it up. That is not a wrong password. A pair tested at T minus fifteen is a pair that is warm at T zero.

If a 407 outlives the minute, re-copy the pair from the dashboard before touching anything else. The warm-up post has a retry loop that waits it out.

4. Exit check: the same IP twice, in the right country

Two requests through port 4243 with the same string. A sticky session answers with the same IP both times; a different IP means the session isn't holding, and the fix is a new session id, not a retry. Then look up the country of that IP and compare it with the store's.

The script at the end does both. For a US store the country comes back US.

5. Lifetime longer than the task

-lifetime- takes 1 to 1440 minutes, and 1440 is the ceiling. Size it to the task with margin: a queue that tends to clear in an hour and a half gets 120, a ten-minute checkout is comfortable on 30. A session still alive an hour after the task ended isn't helping it.

6. The nearest gateway

Three gateways, one pool: eu-, us- and ap-residential2.basilproxies.com. Pick the one nearest the machine running the tasks. The exit country comes from the token, so a bot in Europe running a US store uses eu with -country-us.

7. Every token on the username, nothing on the password

The format is http://USER-<tokens>:PASS@<gateway>:<port>. The password never changes. Country, city, session and lifetime all ride the username, in that order, and the generator always emits that order. A token written on the password isn't targeting anything.

8. An alert set

DM /alerts to the Basil bot and set a low-balance threshold. It DMs you when the balance drops below it. On a drop that uses more than you planned, that message is the difference between topping up at task 40 and finding out at task 60.

9. A team on one account uses sub-accounts

Up to five sub-accounts under one login, each with its own credentials and balance. Move gigabytes from Main to a sub-account and back, set a sub-account to refill itself when it drops below 1 GB, and reset one sub-account's password when a seat changes hands. Its old strings stop working within about a minute, and its data stays. One seat's mistake stays on one seat.

10. The statistics page open

Open the dashboard's statistics page in a tab before the drop and leave it there. It shows bandwidth and requests from 24 hours to 30 days, a success rate and latency, and a per-domain table of your top targets. During the drop, a sinking success rate on the store's domain is the first thing to look at, before the bot's own log.

The script: balance and exit in one run

This runs as written once you put in your own string and the store's country. It stops at the first failed check and says which.

#!/usr/bin/env bash
# pre-drop.sh: balance + exit check, 15 minutes before a drop.
# Needs BASIL_API_KEY (dashboard: Tools → API) and one of the sticky strings you generated.
set -u

PROXY="http://USER-country-us-session-k4mz61pq-lifetime-120:[email protected]:4243"
WANT="US"   # the store's country, two letters, uppercase, as ipinfo prints it

echo "== balance =="
curl -s https://api.basilproxies.com/api/v1/balance \
  -H "Authorization: Bearer $BASIL_API_KEY"
echo

echo "== exit, twice =="
A=$(curl -s --max-time 20 -x "$PROXY" https://api.ipify.org) || A=""
[ -n "$A" ] || { echo "no answer through the proxy: a fresh pair can 407 for about a minute, wait and retry"; exit 1; }
B=$(curl -s --max-time 20 -x "$PROXY" https://api.ipify.org)
C=$(curl -s --max-time 20 -x "$PROXY" https://ipinfo.io/country)
echo "first:   $A"
echo "second:  $B"
echo "country: $C"

[ "$A" = "$B" ] || { echo "NOT STICKY: new session id, run again"; exit 1; }
[ "$C" = "$WANT" ] || { echo "WRONG COUNTRY: check the -country- token"; exit 1; }
echo "OK: same IP twice, exit in $WANT"

A no answer on a brand-new pair is the warm-up from item 3: wait a minute and run it again. A different IP on the second request means a new session id. A wrong country means the -country- token.

What this checklist doesn't do is promise a checkout. We answer for the proxy being live and reachable from the country you asked for; what the store does with a request is the store's. The checks above make sure the first half of that is true before the clock starts.

Run it before the next Pokémon Center drop or ticket on-sale, and keep the script where the bot lives.