A login travels with your settings; a whitelist is tied to the address you connect from. Here is how to choose for each tool.
With username and password the client proves itself on every connection: an HTTP proxy answers 407 with a Proxy-Authenticate challenge, and the client repeats the request with its login; a SOCKS5 proxy runs the username/password step defined in RFC 1929.
With an IP whitelist the provider keeps a list of source addresses and lets those through without a login. The proxy sees only the public address of your connection, so anyone who connects from the same address is treated as you. Not every provider offers it, and the list has to be edited each time your address changes.
| Item | Username and password | IP whitelist |
|---|---|---|
| Your public IP changes (home broadband, phone hotspot, travel) | Keeps working: the login does not depend on your address | Stops working until you add the new address |
| Many machines or servers use the same proxy | Put the same login in each config | Every machine's public address must be on the list |
| An office, café or any network many people share | Only people who have the login can use it | Everyone behind the same public address can use it |
| The tool has no login field (host and port only) | Needs a local forwarder that holds the login | Works only if the provider offers a whitelist |
| Chrome or Edge with a SOCKS5 proxy | Not supported in the browser: use an HTTP proxy with the login | The browser still needs a proxy that needs no login |
Reasoning from RFC 9110, RFC 1928, RFC 1929 and the Chromium proxy notes (read 15 November 2026). Whether a whitelist exists depends on the provider; Proxy302 is used with a login.
SOCKS5 lists three methods in RFC 1928: no authentication, GSSAPI and username/password. Chrome does not implement a SOCKS5 login, so in a browser you give an HTTP proxy and let the browser ask for the login.
The SOCKS5 password step sends the password in cleartext on the way to the proxy, as RFC 1929 states. That is one more reason to keep the login private and not to reuse it elsewhere.
Every IP in My assets comes with a host, a port, a username and a password. HTTP uses port 2222 and SOCKS5 uses port 3333, and each IP is issued with one protocol. Plan the setup around that login.
For a tool that cannot take a login, run a small forwarder such as gost or 3proxy on your own machine: the tool connects to 127.0.0.1 without a login and the forwarder adds yours. Keep that local port private.
If it has login and password fields, use the login. If it has only host and port, go to step 3.
Copy host, port, username and password instead of typing them, and match the type to the port: HTTP for 2222, SOCKS5 for 3333.
Run a local forwarder with your login and point the tool at 127.0.0.1 and its port.
Run the curl lines below. The first two should print the exit IP; the last one, with no login, should answer 407.
Expected result Exit IP for the login lines and 407 for the line without a login.
# Login in the proxy string (works the same for every machine)
curl -x http://LOGIN:PASSWORD@HOST:2222 https://ipinfo.io/json
curl -x socks5h://LOGIN:PASSWORD@HOST:3333 https://ipinfo.io/json
# The same request without a login: a proxy that wants a login answers 407
curl -i -x http://HOST:2222 https://ipinfo.io/jsonExample only: replace the placeholders with the values from My assets and use the line that matches the protocol of that IP. A 407 on the last line shows the proxy wants a login.
Check Is the login copied in full, with the right protocol and port?
Fix Copy it from My assets, then test with curl. See the 407 guide.
Stop when If curl fails with a copied login, stop changing the tool and send Support the order number.
Check Does the tool pass credentials to the proxy at all?
Fix Use a local forwarder so the tool needs no login.
Check Are you relying on a whitelisted address?
Fix Use the login, which does not depend on the network you are on.
They protect different things. A password can be used from anywhere by whoever has it; a whitelist trusts every device behind the listed public address. Keep either one private.
This page describes only the login method: each IP in My assets has a username and password. If a tool cannot take a login, use a local forwarder.
A 407 means the proxy did not accept the credentials it received. Check the port and protocol, then copy the login again.
Chrome and Edge cannot. Give the browser an HTTP proxy and enter the login when it asks.
A static residential IP costs US$0.50 for 1 day and US$7.99 for 30 days, the same in every country. There is no free trial; the smallest purchase is one IP for one day.
HTTP 407 Proxy Authentication Required comes from the proxy server, not from the website you are trying to reach.
One gost line on 127.0.0.1 lets a tool with only host and port fields use a proxy with a login (SOCKS5 port 3333, HTTP port 2222).
Chrome has no SOCKS5 login, but a static ISP per-IP lease also works on HTTP port 2222 with the same login.
SOCKS5 on all three lines: rotating residential from US$1.50/GB, static ISP and datacenter IPs per IP and term. Port 3333 with username and password, and the errors you see when a setting is wrong.
Fixed static ISP proxies: a residential-grade IP that stays the same for the whole term. For social accounts, stores and AI tools. HTTP and SOCKS5.
View options and pricingOfficial documentation · Confirmed on:
Read on 15 November 2026: section 15.5.8 says 407 (Proxy Authentication Required) is similar to 401 but means the client must authenticate to use a proxy; the proxy must send a Proxy-Authenticate header with a challenge, and the client may repeat the request with a Proxy-Authorization header.
Official documentation · Confirmed on:
Read on 15 November 2026: the method list has NO AUTHENTICATION REQUIRED (X'00'), GSSAPI (X'01') and USERNAME/PASSWORD (X'02'); implementations should support username/password.
Official documentation · Confirmed on:
Read on 15 November 2026: defines the username/password sub-negotiation; the security section says the password travels in cleartext, so it is not recommended where sniffing is practical.
Official documentation · Confirmed on:
Read on 15 November 2026: Chrome does not use credentials embedded in manual proxy settings, and proxy authentication goes through the ordinary flow of finding credentials; the page lists HTTP, HTTPS, SOCKSv4 and SOCKSv5 as supported proxy schemes.
Product observation · Confirmed on:
Product facts file of the site (values checked against the console, the backend and the price table in October 2026, protocol tests of 4 November 2026): products, prices in US$ (1 PTC = US$1), lease terms, protocols and ports, countries, no free trial.
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.
