How to use PanAIO: Setup, proxies, and your first drop

The first release I ran with PanAIO, I had 40 tasks queued and every one of them sat on Retrying init 429 until the product sold out.

The bot was fine. My proxies were rate-limited before the drop even opened, and I'd copied delay values from a YouTube video for a mode I wasn't running.

This guide walks the whole setup: install, profiles, accounts, proxies, task modes, and the delay numbers that match each mode.

It also includes a pre-drop dry run. That's how you find out your setup is broken on a Tuesday afternoon instead of thirty seconds before a release.

What is PanAIO?

PanAIO is a Windows desktop checkout bot that automates purchases across roughly 100 retailers, most of them European. It runs tasks against a site, spreads requests across proxies, and hands captchas off to third-party solvers. Licensing is a monthly renewal, not a one-time purchase.

The site list leans hard toward the EU: Zalando, About You, ASOS, LVR, Snipes, Courir, BSTN, Footshop.

Amazon, Shopify, and Nike are supported too, alongside a growing collectibles side covering Pokémon Center, Popmart, Funko, and Panini.

Everything runs locally on your machine. There's no cloud component doing the checkout for you, which means your hardware, your connection, and your proxies are the whole performance story.

That's worth internalizing early. Most "the bot is slow" complaints turn out to be proxies.

What PanAIO actually costs

This is where nearly every guide on the first page of Google is wrong, including one I wrote a while back. PanAIO is not a $325 lifetime license.

Per the official FAQ, it's a renewal fee of €49.99 + VAT every month. If you stop paying, you stop botting.

The license is also the smallest line item. Here's the honest monthly picture:

Two hundred euros a month is a real number that needs a real return. If you're copping one pair a season for yourself, manual checkout and a good cook group will cost you less.

Prerequisites

Before you touch the bot:

• Windows 10 or 11. PanAIO is Windows-only. No macOS build, no Linux build.
• A Discord account. Both the download and your login run through Discord.
• A purchased license, tied to that Discord account.
• Proxies. One task on one site is fine without them. Anything beyond that isn't.
• A captcha solver account with credit loaded.
• A payment method you're comfortable exposing to a desktop app running dozens of parallel sessions.

Step 1: Install PanAIO

There's no installer on the website. The build lives in the #download channel of the PanAIO Discord, which you get access to after buying a license.

Download the zip, extract it to a real folder on your desktop, and run the panaio executable. Then log in with Discord.

Do not run it from inside the zip. The bot writes session files, CSV exports, and logs next to the executable, and a temp directory will silently break all of it.

The first-run problem everyone hits: Windows Smart App Control blocks the executable outright. It's an unsigned binary that spawns a lot of network connections, which is exactly the profile Smart App Control exists to stop.

Turn it off under Privacy & Security → Windows Security → App & browser control → Smart App Control settings. PanAIO documents this with screenshots on their Windows Protection page.

Add a Defender exclusion for the PanAIO folder too, or it will quarantine files mid-drop.

That's a real tradeoff, not a formality. You're disabling a security control for an unsigned binary distributed through Discord. Make that call consciously.

Last piece: install the PanAIO Chrome extension. Grab the zip from the extension channel and extract it.

In Chrome, go to More tools → Extensions → Load unpacked and point it at that folder. Pin it afterward.

Enable "Use proxy when opening cookie links" while you're there. Cookie links will open through the task's proxy instead of your home IP.

Step 2: Build your profiles

A profile in PanAIO is one shipping address plus one payment method. Tasks pull from profiles at checkout.

Build one clean, correct profile first and test it end to end before you clone it fifty times. A typo in a postcode multiplies beautifully.

Profiles support jigging, which is small formatting variation across otherwise identical addresses. PanAIO gives you shortcuts for it:

random random     → generates a first and last name (Jean Delemare)
xxx               → 3 random letters (ABC)
07xxxxxxxx        → random digits in a phone number

You can also pad street names or apartment lines so no two profiles look byte-identical. The purpose is avoiding automated order cancellation when a retailer clusters orders by address.

Be realistic about what you're doing here. Jigging exists to work around per-customer purchase limits, and retailers absolutely cancel orders they identify this way. Push it too far and the courier can't find the address either.

Profile linking is the quieter feature worth using: put an account's email in the profile's email field, and that account will always pair with that profile. Consistent account-to-address pairing looks a lot less strange to a fraud system than random shuffling.

Step 3: Add or generate accounts

Most EU sites need a logged-in account to checkout at drop speed. PanAIO handles both imported accounts and generated ones.

Generated accounts need a captcha solver and an SMS provider wired up first, since signup flows ask for both. The bot supports SMSPool, SMS-Activate, and custom providers through a documented API spec.

Two rules that save a lot of pain:

Run more accounts than tasks. The About You docs say this outright, and it holds everywhere. Accounts get shadowbanned, sessions expire, and a task with no available account just sits there.

Warm your sessions early. PanAIO's Session mode logs accounts in and stores the session, so tasks don't burn proxy data on login at drop time. Run it the night before. Login endpoints are the most aggressively defended part of any retail site, and fighting them at T-minus-30-seconds is how you lose.

Zalando also has an Account Tester mode that checks whether each account can cart a restricted item. It keeps the cartable ones and deletes the rest, so export your account group first if you want a backup.

Step 4: Set up proxies in PanAIO

Proxies are the part that decides whether any of this works.

Go to the proxy section, click ADD GROUP, name it, then select the group and click ADD PROXIES. Two formats are accepted, one per line:

# credential auth
198.51.100.7:8000:username:password

# IP-whitelist auth
198.51.100.7:8000

Name groups by job and region, not by provider. zalando-de-dc, monitor-isp, aboutyou-resi tells you something at 09:58 on a drop day. proxies1 does not.

Which proxy type for which job

PanAIO's own site guides contradict each other if you read them out of context, because the right answer genuinely changes per site and per task type. Here's the consolidated version:

If you're unclear on where ISPs sit between the other two, our breakdown of ISP proxies and static residential IPs explains the tradeoff.

Rule of thumb on volume: one clean IP per task. Fifty tasks, fifty IPs. Reusing one IP across multiple accounts is the fastest way to get an entire account group clipped at once.

For the residential and ISP side we run Roundproxies pools ourselves, though the type matters far more than the vendor.

Our guide on residential vs. datacenter proxies covers where each one falls over.

Why PanAIO's "Check All" isn't enough

The bot's built-in proxy tester tells you a proxy is alive and how fast it responds. It does not tell you whether that proxy is already banned on the site you're about to run.

Those are completely different questions, and the second one is what kills drops.

I check against the actual target before every release with a small script. Nothing exotic, just a threaded request against the site through each proxy:

# proxycheck.py - run the morning of a drop, not five minutes before
import concurrent.futures, requests

TARGET = "https://www.zalando.de/"   # swap for the site you're running
TIMEOUT = 8

def check(line):
    ip, port, user, pw = line.strip().split(":")
    proxy = {"https": f"http://{user}:{pw}@{ip}:{port}"}
    try:
        r = requests.get(TARGET, proxies=proxy, timeout=TIMEOUT)
        return line, r.status_code, r.elapsed.total_seconds()
    except Exception as e:
        return line, "DEAD", type(e).__name__

The function returns the raw status code rather than a boolean, because a 403 and a timeout mean very different things. A 403 is a ban. A timeout is usually a dead proxy.

Now run it across the list:

with open("proxies.txt") as f:
    lines = [l for l in f if l.strip()]

with concurrent.futures.ThreadPoolExecutor(max_workers=25) as pool:
    for line, status, detail in pool.map(check, lines):
        if status == 200 and detail < 1.5:
            print("OK  ", line.strip(), f"{detail:.2f}s")
        else:
            print("BAD ", line.strip(), status, detail)

Anything that isn't a fast 200 gets pulled from the group before the drop. Keep max_workers moderate, since hammering the target with 200 concurrent checks is its own way to get a subnet flagged.

One caveat: a clean homepage response doesn't guarantee a clean checkout endpoint. Some bans only appear at the payment step. It still catches the majority of dead weight, and it takes forty seconds.

Step 5: Create your first task group

Tasks live inside task groups, and the group is where the site is chosen. Click ADD GROUP, pick your site, name it, and attach a Discord webhook.

Group-level settings worth knowing:

• Start delay staggers task launches, in milliseconds. Ten tasks at 1000ms means one task per second. Useful for not slamming a site with a synchronized burst.
• ACO set to Active lets PayPal checkouts complete on their own. Set the PayPal field to webhook instead if you'd rather get payment links pushed to Discord and confirm manually.

Then ADD TASK. Fields vary by site, but the common ones:

Dummy products cause more confusion than anything else in the bot. On sites with exclusive drops, the dummy must match the product type. Zalando needs an exclusive dummy for exclusive modes and a normal one otherwise. If a task hangs on Retrying preload 200, your dummy is wrong.

You can tell which type a Zalando product is from the button on the product page. "Buy now" means exclusive. "Add to cart" means normal, and you run the non-exclusive modes.

A few shortcuts matter under time pressure. Ctrl+A selects everything, and shift-click selects a range.

The one to memorize: double-clicking a status selects every task sharing it. That's how you restart only the errored tasks without touching the working ones.

Don't drag tasks between groups while they're running. It corrupts their state.

Step 6: Get your delays right

Every task has a restock delay (time between checkout attempts) and a cart delay (time between add-to-cart attempts), both in milliseconds.

Copying someone else's delays without matching the mode is the single most common configuration mistake I see. Exclusive modes need roughly three times the spacing of fast modes, because they hit heavier endpoints that rate-limit sooner.

PanAIO's suggested starting values, using Zalando as the reference:

That last row is not a typo, and it catches people constantly. In account test mode, "cart delay" is a count of add-to-cart attempts, not a duration. A value of 2 means two attempts, not two milliseconds.

Lower delays are not automatically better. Aggressive spacing on exclusive endpoints gets you rate-limited into uselessness.

A task idling in waiting also burns residential bandwidth. If you've got long gaps between drops, raise the delay instead of paying for data you're throwing away.

Step 7: Monitors and wait tasks

A monitor watches products and fires waiting tasks the moment a restock is detected. This is the right pattern for anything you don't have an exact drop time for.

Set the monitor's proxy group to ISPs, since it holds long connections and doesn't need burst speed. Then click PASTE LINK/PID, add the product, and click its image to pick sizes.

The part people miss: tasks must have "waiting for monitor" enabled, or they'll never fire. Configured correctly, they sit at Waiting monitor... until the monitor reports Restock found.

Keyword matching supports + for compound matches. nike+dunk,adidas+campus matches any item containing both Nike and Dunk, or both Adidas and Campus.

The bolt button adds a product to a running monitor and starts the associated tasks immediately, which is what you reach for during a surprise restock. Monitor settings can be changed live without a restart.

Step 8: Connect a captcha solver

PanAIO doesn't solve captchas itself. It routes them to third-party solvers you fund separately, and drops the API key into Settings → Captchas.

Supported solvers include Capsolver, CapMonster, 2Captcha, Anticaptcha, SolvNow, and AYCD AutoSolve. You can also select multiple solvers for one captcha type, and PanAIO will pick randomly among them.

That randomization is more useful than it looks. Weight it by listing a solver twice.

Two entries for Capsolver and one for SolvNow gives you a rough 2:1 split. One solver going down mid-drop no longer takes you with it.

Check your balance before every release. waiting for captcha almost always means an empty account, not a broken solver.

The pre-drop dry run

Here's the section none of the other guides have, and it's the one that changed my hit rate most.

Test your entire pipeline on a boring, in-stock, unhyped product before you rely on it for a real release. A €20 t-shirt that's been sitting in stock for six months is a perfect target.

Run this the day before, not the morning of:

1. Sessions. Run Session mode across your account group and confirm they log in cleanly. Anything failing here fails harder under load.
2. Proxies. Run the script from Step 4 against the actual target domain. Purge anything that isn't a fast 200.
3. Accounts. For Zalando, run Account Tester with a genuinely restricted dummy. Non-cartable accounts get removed automatically.
4. A real checkout. Actually buy the boring product, end to end. This is the only way to verify your payment method, address format, and profile are all correct.
5. Webhooks. Confirm the Discord webhook fires. If checkouts land and no webhook arrives, PayPal links are recoverable from the Analytics section, but you don't want to learn that live.
6. Captcha balance. Top it up.

The completed test checkout is the important one. Every other step tells you a component works. Only a real order tells you the whole chain works.

I've had setups pass steps one through three and still fail at payment because a card's billing address had a different postcode format than the profile. You cannot find that without buying something.

PanAIO error messages, decoded

The bot surfaces raw HTTP codes, which is honest but unhelpful if you don't read them daily.

Two patterns cover most of these. Anything in the 4xx range that isn't 404 points at your proxies. Anything mentioning sessions or accounts points at account health.

Our guide to why sites return 403 and how detection works goes deeper on what actually triggers them.

Checkout failed deserves special mention because it's the most misdiagnosed. People change proxies first when clearing the account session usually fixes it. Clear the session, retry, and only then start swapping IPs.

What PanAIO won't fix

Being blunt about the limits, since the marketing won't be.

It won't beat a raffle. Raffle modes enter you into the draw. They don't weight the outcome. More entries across more accounts is the entire mechanism, and retailers are increasingly good at spotting clustered entries.

It won't stop cancellations. Zalando, Kith, and Nike cancel bot orders after the fact all the time. A checkout confirmation isn't a delivered pair, and jigged addresses raise your cancellation risk as much as they reduce it.

It won't compensate for bad proxies. No mode, delay, or setting rescues banned IPs. Proxy quality is the ceiling on everything else.

It won't run unattended. Sites patch, modules break, and PanAIO ships fixes through Discord. If you're not in the server reading updates, you're running yesterday's build against today's site.

And the obvious one: automated checkout violates the terms of service of effectively every retailer here. Accounts get banned, orders get voided.

For some categories it goes further than ToS. Automated ticket purchasing in the US is illegal under the BOTS Act, not merely against the rules.

Know which side of that line your target sits on before you run anything.

FAQ

Does PanAIO work on Mac?

No. PanAIO is Windows-only, per the official FAQ, with no macOS or Linux build. A Windows VM on Apple silicon works but adds latency you can't afford at drop time. Most Mac users run a separate Windows machine or a Windows VPS.

How much does PanAIO cost?

€49.99 plus VAT per month, as a recurring renewal. Any guide telling you it's a $325 lifetime license is out of date. Budget €100–150 monthly once proxies, captcha credits, and SMS credits are included.

How many proxies do I need?

One clean IP per task is the working rule. Fifty tasks means fifty IPs. You can run a single task without a proxy, but sharing IPs across accounts risks losing an entire account group at once.

Why do my orders keep getting cancelled?

Usually address clustering or payment mismatch. Retailers cancel multiple orders headed to the same address, which is what jigging tries to work around. Also check that your billing address matches your card exactly, including postcode format.

Should I use datacenter or residential proxies with PanAIO?

It depends on the site. Zalando checkout tasks favor datacenter for speed. About You, ASOS, and Amazon rate-limit datacenter and ISP within hours, so residential lasts longer. Monitors run best on ISPs. Most people running seriously use all three.

What does "Retrying preload 200" mean?

Your dummy product is wrong for the mode you're running. Exclusive modes need an exclusive dummy, normal modes need a normal one. Check the product page button: "Buy now" is exclusive, "Add to cart" is normal.

Wrapping up

The bot is the easy part. Install it, point it at a site, and it'll run.

Everything that decides whether it works sits underneath: clean proxies matched to the task type, warm account sessions, correct delays, and a dummy product that fits.

Get those four right and PanAIO does what it says. Get one wrong and you'll be reading 403s while the drop sells out.

Do the dry run. Buy the boring t-shirt. It's the cheapest lesson available.

Start with the official PanAIO documentation for site-specific quirks, since each retailer module has its own modes and gotchas that no general guide can cover. If you're scripting around the bot, the QuickTask documentation covers remote task creation.