Dotpane-Proxy
Last updated:
If you run an API and found this address in your logs, a Dotpane user called your API from one of their panes. This page explains what that means and what you can do about it.
User-Agent: Dotpane-Proxy/1 (+https://dotpane.com/proxy)
What Dotpane is
Dotpane is a web app where people build small dashboard components, called panes, in HTML, CSS and JavaScript. A pane cannot reach the network itself. When it needs data from an API, Dotpane makes the request from its servers and adds the user’s API key there, so the key never reaches the browser. How that works.
Why it called your API
- Each request was asked for by a signed-in Dotpane user, from a pane on their own canvas.
- It went to a host the user listed in that pane. Dotpane does not choose hosts and does not crawl.
- Any key or token in it is one the user stored with Dotpane and chose to send to your host.
What every request follows
- No more than 60 calls a minute from one Dotpane account, in total across all its panes.
- A call is stopped after 10 seconds or after 2 MB of response.
- Redirects are never followed, and private or internal addresses are never called.
- A pane can ask Dotpane to reuse a GET response for up to an hour, so that it does not call you again.
The user agent above is sent when the pane does not set its own. A pane may set a different one, so the user agent alone does not show every request that came through Dotpane.
How to block it or report it
You can refuse requests whose user agent starts with Dotpane-Proxy, or revoke the key that is being used. Dotpane does not publish a fixed list of addresses.
If the calls break your terms, use too much of your service, or look like an attack, email support@dotpane.com with the times, the paths called and, if you can, the key that was used. Using Dotpane this way breaks our Acceptable Use Policy, and we can stop the pane or the account. Security problems in Dotpane itself go to security@dotpane.com.