407 Proxy Authentication Required: Causes and Fixes

How 407 Differs from 401 and 403

These three status codes look similar but point to entirely different places in the network path.

401 Unauthorized means the destination server does not recognize or accept the credentials you presented. The server is saying it needs to know who you are before it serves the requested resource, and it will usually include a WWW-Authenticate header explaining what kind of token or login it expects. You fix 401 by correcting credentials with the target site — not the proxy.

403 Forbidden means the server understood the request and refuses it, whether or not you are signed in, for example because of account permissions or a block on your IP or region. Re-sending the same credentials will not change the outcome.

407 Proxy Authentication Required belongs to the proxy, not the origin server. The proxy sits between you and the destination, and it has decided that your traffic needs a valid username and password before it will relay anything. Only after the proxy accepts your credentials does it forward your request — at which point the destination server may still return 401 or 403 for reasons of its own. The key headers differ too: 401 responses carry WWW-Authenticate while 407 responses carry Proxy-Authenticate. If you are debugging with verbose logging, that header is the clearest signal you are looking at the proxy, not the website.

The Five Most Common Causes

Most 407 errors trace back to a small set of configuration mistakes. Working through them systematically saves time.

1. Missing or incorrect username and password. The proxy credentials may never have been included in the request at all, or they may contain a simple typo. Double-check the username and password against what your provider issued. A case mismatch or a stray space at the end of the field is enough to cause failure.

2. Credentials placed in the wrong field. Many HTTP client libraries and tools distinguish between target-site credentials and proxy credentials. The Authorization header authenticates you to the destination server; the Proxy-Authorization header authenticates you to the proxy. Putting the proxy username and password into the Authorization field produces a 407 every time, because the proxy never sees them.

3. Special characters not URL-encoded. Characters such as @, :, %, #, and & carry special meaning inside a URL. If your password is P@ss:w0rd%, the @ will break the user:password@host parsing and the % may be interpreted as the start of an escape sequence, silently changing the password that the proxy receives. The fix is to URL-encode each special character — for example @ becomes %40. In Python use urllib.parse.quote(), in JavaScript use encodeURIComponent().

4. IP allowlist does not include your address. Some proxy providers restrict access to a list of approved source IPs rather than requiring per-request credentials. If the public IP address you are sending from is not on that list, the proxy may return 407 or close the connection before it even looks at a username or password. Confirm which IP the proxy sees — you can do this with a simple curl command — and verify it matches what your provider has recorded.

5. Wrong protocol for the endpoint. An HTTP proxy cannot authenticate a SOCKS5 client, and a SOCKS5 proxy will not accept an HTTP request. A protocol mismatch usually shows up as a connection or handshake error rather than a 407: an HTTP client on a SOCKS5 port gets no HTTP response at all. Check it anyway before you re-enter credentials. On Proxy302, use http:// with port 2222 and socks5h:// with port 3333, matching the protocol of the asset you bought.

Test the Proxy First with curl

Before touching application code, test the proxy from your terminal with curl.

Use -x to point curl at your proxy. A call without credentials looks like this:

Test the Proxy First with curl: example

curl -v -x http://proxy.example.com:8080 https://ipinfo.io/json

Example only: replace the placeholder values with your own.

Test the Proxy First with curl, continued

The -v flag prints the full conversation, including the Proxy-Authenticate challenge from the proxy and the Proxy-Authorization header curl sends back. If the proxy requires a username and password, add them with the -U flag:

Test the Proxy First with curl: example

curl -v -x http://proxy.example.com:8080 -U "myuser:mypassword" https://ipinfo.io/json

Example only: replace the placeholder values with your own.

Test the Proxy First with curl, continued

If this succeeds — you see HTTP 200 from the target — the proxy credentials are correct and the problem lies in how your application is passing them. If it still fails with 407, the credentials themselves are wrong or the IP is not allowed. -U is short for --proxy-user and sends the credentials to the proxy; -u (--user) sends them to the destination server. The two are easy to mix up.

Fix It in Your Browser

Browsers normally prompt for proxy credentials when they receive a 407. If you see the error instead of a prompt, check the address and port in the OS proxy settings, remove saved proxy credentials (Windows Credential Manager or macOS Keychain) and reload so the browser asks again; to store the login and password, use a proxy extension. macOS also lets you enter them under System Settings → Network → Details → Proxies. On company networks that use Windows-domain sign-in for the proxy, ask your IT team.

Fix It in Python Requests

The requests library passes proxy credentials inside the proxies dictionary. Construct the proxy URL with the username and password embedded, and remember to encode any special characters:

Fix It in Python Requests: example

import urllib.parse

username = "myuser"
password = "P@ss:w0rd%"
encoded_password = urllib.parse.quote(password, safe="")

proxies = {
    "http":  f"http://{username}:{encoded_password}@proxy.example.com:8080",
    "https": f"http://{username}:{encoded_password}@proxy.example.com:8080",
}

Example only: replace the placeholder values with your own.

Fix It in Python Requests, continued

Two common mistakes: omitting the https key (HTTPS requests then go out directly, without the proxy, so you see your own IP instead of a 407) and leaving the password unencoded, which does produce 407.

As an alternative, set the HTTP_PROXY and HTTPS_PROXY environment variables. On macOS or Linux: export HTTP_PROXY="http://user:pass@host:port". On Windows PowerShell: $env:HTTP_PROXY = "http://user:pass@host:port". Requests reads these automatically.

Fix It in Node.js

On Node.js 24.5+ (or 22.21+), set NODE_USE_ENV_PROXY=1 together with HTTPS_PROXY=http://user:pass@host:port and the built-in http/https and fetch use the proxy. On older versions, or for SOCKS5, use https-proxy-agent or socks-proxy-agent and encode the password with encodeURIComponent.

• Sources:
• Node.js docs: Built-in Proxy Support

Fix It with Environment Variables

Many command-line tools and libraries read HTTP_PROXY and HTTPS_PROXY from the environment (these are separate from the Windows/macOS system proxy settings) in the form http://username:password@host:port. Set them in your shell profile on macOS or Linux, or in the environment variables dialog on Windows.

When to Ask the Provider

Contact the provider when the address, port, protocol and credentials are all correct and the error persists. Typical cases are an allowlist not yet updated for your current public IP, credentials not yet activated, or an endpoint that is offline.

How to do it with Proxy302

Rotating residential proxies fit this task: you choose the exit country (195+ countries and regions, with state and city on lines that support it) and pay per GB, so you pay only for the traffic you use. The rotating residential page has the setup. The table below shows where exits in 7 countries landed in our latest hourly check; the probe sends its request to ChatGPT, which is only an example target. To check your own exit, use the proxy location guide.

• rotating residential page
• proxy location guide

Measured exits: ChatGPT from 7 countries

Hourly check of the Proxy302 probe, 23 October 2026, 15:47 UTC: one request to ChatGPT per country through a dynamic residential exit, using the public Proxy302 entry. Only the first three octets of an IP are public. One sample per country, not an average; later checks will differ.

• Sources:
• Proxy302 hourly connectivity check

How to do it with Proxy302: steps

1. Step 1

   Open the rotating residential page, choose the line, and keep Protocol on HTTP or choose SOCKS5, then click Review cost and generate.

2. Step 2

   Open My assets (the console page that holds everything you bought) and copy HOST, PORT, USERNAME and PASSWORD. The Connect page shows a ready example with your own endpoint.

3. Step 3

   Enter the details in the browser or tool you are setting up.

4. Step 4

   Confirm the exit with https://ipinfo.io/json through the proxy.

5. Step 5

   From mainland China, start the helper tool from the Connect page first and keep it open while you use the proxy.

   • Helper tool guide

Prices and limits

The Budget line costs US$1.50 per GB, US$1.35 per GB in a 100 GB package and US$1.20 per GB at 300 GB. There is no free trial, and the smallest purchase is 1 GB. Which exit locations are available changes daily.

• Sources:
• Proxy302 product facts and price list

FAQ

Read next

Proxy address, port, username and password

Every working proxy is described by five basic fields: protocol, host address, port, login, and password.

Check a proxy's IP, country and ISP

Check the exit IP, country and ISP your proxy really gives you in 30 seconds — and why IP databases disagree on the city. With our own test of three lookup services.

Rotating residential proxies

Real household IPs in 195+ countries with state and city targeting. Rotate on every request or keep sticky sessions. From US$1.50/GB, US$1.35/GB at 100 GB. HTTP and SOCKS5.

View options and pricing

Fix ERR_PROXY_CONNECTION_FAILED

The ERR_PROXY_CONNECTION_FAILED error appears in Chrome and Edge when the browser cannot establish a connection with a proxy server.