407 Proxy Authentication Required: Meaning and Fixes

407 Proxy Authentication Required is an HTTP status code sent by a proxy, not by the website. It means the proxy will not forward your request until it gets valid proxy credentials. If you are browsing, enter your network's proxy login. If you run a scraper or bot, check the proxy username, password, host, port, and protocol first.

This is different from a website login error. A 407 comes from the proxy, before the request reaches the target site. In scraping tools, browsers, bots, cURL, Python clients, Playwright, Puppeteer, and mobile apps, it usually points to a bad proxy username, password, host, port, protocol, or account status.

If the proxy works in one tool but fails in another, use the proxy converter to reformat the same host, port, username, and password before replacing the proxy.

407 Proxy Authentication Required: quick fix

Start with the most common causes:

If you are seeing 407 Proxy Authentication Required, do not start by changing target headers or rotating IPs. First prove that the proxy credentials are accepted.

Who sees a 407 and what to do first

• If you are a visitor on a work, school, or hotel network, your traffic goes through a proxy that wants a login. Enter the proxy credentials your network administrator gave you, or ask for them.
• If you run scrapers, bots, or automation, the proxy is the one you configured. Test one proxy with curl -v and fix the credentials, protocol, or allowed IP before touching the scraper.
• If you run a website and your users report a 407, the response comes from a proxy in front of your origin or from the origin's upstream proxy. Cloudflare's docs say Cloudflare does not generate 407 errors, so check the proxy authentication settings in your own stack.

What 407 Proxy Authentication Required means

HTTP 407 is a 4xx client error status code defined in RFC 9110, section 15.5.8:

The 407 (Proxy Authentication Required) status code is similar to 401 (Unauthorized), but it indicates that the client needs to authenticate itself in order to use a proxy for this request. The proxy MUST send a Proxy-Authenticate header field (Section 11.7.1) containing a challenge applicable to that proxy for the request. The client MAY repeat the request with a new or replaced Proxy-Authorization header field (Section 11.7.2).

MDN describes it the same way: the request lacks valid credentials for a proxy server that sits between the client and the server that has the resource.

Two headers do the work:

They mirror WWW-Authenticate and Authorization, which a website uses with 401. The difference is the audience. Proxy-Authorization is only for the next proxy that asked for it, and the proxy does not pass it on to the target site.

A typical exchange with Basic authentication looks like this:

GET http://example.com/ HTTP/1.1
Host: example.com

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="proxy"

GET http://example.com/ HTTP/1.1
Host: example.com
Proxy-Authorization: Basic dXNlcjpwYXNz

dXNlcjpwYXNz is the Base64 form of user:pass. Base64 is encoding, not encryption, so anyone who can read the traffic between you and the proxy can read Basic credentials.

Why a 407 looks different on HTTPS

For HTTPS targets, the client first sends a CONNECT example.com:443 request to the proxy. The 407 comes back in reply to that CONNECT, before any TLS starts. That is why curl -v shows the 407 before the TLS handshake, and why the target site never sees the request.

Many libraries hide this. Instead of returning a response object with status_code == 407, Python requests raises a ProxyError that mentions Tunnel connection failed: 407 Proxy Authentication Required. If your code only checks status codes, it never sees the failure. Catch the exception and log the message.

Background services and headless tools have another problem. A browser can show a login prompt for Basic or Digest authentication. A service without a UI cannot, so it fails instead of asking.

Credential formats

The host and port form the proxy address. The username and password are separate. Providers give you all four in one of these formats:

host:port:username:password
http://username:password@host:port
socks5://username:password@host:port

Some tools want the full URL. Some want host, port, username, and password in separate fields. Some want no scheme at all. A format mismatch is one of the most common reasons valid proxies return 407.

SOCKS5 proxies do not use HTTP status codes. A SOCKS5 authentication failure shows up as a connection or handshake error in your tool, not as a 407.

407 vs 401 vs 403

These errors are easy to mix up:

If a target API returns 401, fix the API token or login. If a website returns HTTP 403 Forbidden, debug permissions, WAF policy, target rules, and IP reputation. If the proxy returns 407, fix proxy authentication first. If the browser never reaches the proxy, you have a connection problem instead, covered in the ERR_PROXY_CONNECTION_FAILED guide. For a wider list of proxy failures, see proxy error meanings and fixes.

Common causes of 407 Proxy Authentication Required

Most 407 errors come from setup details.

Check these first:

• Wrong username.
• Wrong password.
• Extra spaces copied into credentials.
• Expired or canceled proxy plan.
• Old credentials after a plan change.
• Wrong host or port.
• HTTP proxy loaded into a SOCKS-only field.
• SOCKS5 URL loaded into an HTTP-only field.
• Credentials placed in the wrong order.
• Special characters in credentials not handled by the tool.
• IP-authenticated proxy used from an unallowed IP.
• Tool strips Proxy-Authorization headers.
• Environment variables override your proxy settings.

Do not debug the target website until you know the proxy accepts authentication.

Less obvious causes of 407

When the username and password look right, the cause is usually one of these.

The IP allowlist rejects you

Some proxies authenticate by source IP instead of, or in addition to, a login. If the request comes from an IP that is not on the allowed list, the proxy can answer 407 even with correct credentials. This often starts after your home, office, or server IP changes. Check which authentication method your plan uses and update the allowed IP if needed.

The account hit a session or concurrency limit

Some providers return 407 instead of 429 when you exceed a concurrent-session limit. If a working proxy starts failing only under load, cut worker concurrency and retest with one request. If the failures are really rate limits from the target, HTTP 429 covers that case.

A percent sign changed the password

URL parsers decode %XX sequences. A password that contains a literal % can be silently rewritten before it reaches the proxy, so the proxy sees a different password than the one you typed. Encode the percent sign as %25, or pass credentials through a separate field such as --proxy-user. The same applies to @, :, /, ?, and #.

The proxy wants a different auth scheme

The Proxy-Authenticate header names the scheme. Basic is the most common one on commercial proxies. Corporate proxies often use NTLM or Negotiate (Kerberos), and a client that only speaks Basic cannot answer them. With cURL you can check what the proxy offers in curl -v output, then pick a scheme with --proxy-basic, --proxy-ntlm, --proxy-negotiate, or let --proxy-anyauth choose one automatically. For NTLM-only proxies, a local forwarder such as Cntlm is the usual workaround.

Redirects and chained proxies drop the credentials

Proxy-Authorization is hop-by-hop. It goes to the next proxy and no further. If you chain two proxies, the first hop consumes the credentials and the second issues its own challenge. Python requests versions before 2.31.0 also forwarded Proxy-Authorization to destination servers on HTTPS redirects, which CVE-2023-32681 fixed. Keep requests at 2.31.0 or later, and put credentials in the proxies dict instead of a manual header.

How to fix 407 in browsers

For browsers, verify the proxy settings directly:

1. Check the proxy host and port.
2. Confirm whether the browser is using HTTP, HTTPS, or SOCKS.
3. Re-enter the username and password.
4. Remove saved wrong credentials for that proxy.
5. Disable conflicting VPN or proxy extensions.
6. Test a single proxy before loading a full list.
7. Try another browser profile to rule out cached credentials.

If the browser prompts for a username and password, the proxy is reachable. If the prompt keeps returning after correct credentials, the username, password, protocol, plan status, or allowed client IP is probably wrong.

For macOS system fields, browser coverage, and rollback steps, follow the Mac proxy settings guide before changing the proxy format.

How to fix 407 in cURL

For cURL, use the proxy URL format explicitly, and add -v to see the proxy's response:

curl -v -x "http://username:password@host:port" "https://example.com"

Or pass the credentials separately, which avoids URL parsing problems:

curl -v -x "http://host:port" --proxy-user "username:password" "https://example.com"

In the verbose output, < HTTP/1.1 407 Proxy Authentication Required followed by a Proxy-Authenticate line means the proxy rejected the credentials. For an HTTPS target, a 200 Connection established line means proxy authentication worked.

For SOCKS5:

curl -x "socks5://username:password@host:port" "https://example.com"

If your password includes special characters such as @, :, /, ?, or #, the URL parser may split it incorrectly. URL-encode the credential (for example @ becomes %40) or use --proxy-user.

How to fix 407 in Python scrapers

In Python, confirm the library supports the proxy protocol you selected.

For requests with HTTP proxies:

proxies = {
    "http": "http://username:password@host:port",
    "https": "http://username:password@host:port",
}

For SOCKS5, install SOCKS support and use the right scheme:

pip install "requests[socks]"

proxies = {
    "http": "socks5://username:password@host:port",
    "https": "socks5://username:password@host:port",
}

If the format is unclear, compare your code against the Python proxy requests examples before changing proxy providers or target settings. For username and password parsing problems in requests, use the Python requests proxy authentication guide.

If your rotating proxy Python script gets 407 on every request, stop the loop and test one proxy manually. Repeated retries with wrong credentials only create noisy logs and can hide the real issue.

How to fix 407 in Playwright or Puppeteer

Chromium does not accept a username and password inside --proxy-server. Pass the credentials separately.

Puppeteer:

const browser = await puppeteer.launch({
  args: ["--proxy-server=http://host:port"],
});
const page = await browser.newPage();
await page.authenticate({ username: "username", password: "password" });
await page.goto("https://example.com");

Playwright:

const browser = await chromium.launch({
  proxy: { server: "http://host:port", username: "username", password: "password" },
});

Check:

• The proxy server includes the correct scheme and port.
• Username and password are passed in the proxy config.
• The browser context is not overriding the launch proxy.
• The same credentials are not accidentally URL-encoded twice.
• The target page is not behind a separate site login.

Keep proxy authentication separate from website authentication. A target login form, cookie, or bearer token does not authenticate you to the proxy.

For Playwright context-level proxies, see the Playwright proxy guide. For Puppeteer-specific connection failures, authentication prompts, tunnel errors, and timeouts, use the Puppeteer proxy server errors guide after confirming whether the response is really a 407. If an AI agent hits 407 through Playwright MCP, check whether a --proxy-server flag is replacing the credentials from your config file, as explained in the Playwright MCP proxy setup guide.

How to fix 407 in npm, apt, and system tools

Command-line tools read proxy settings from their own config or from environment variables, and a stale value in either place keeps returning 407.

# Shell environment, read by curl, wget, pip, and many others
export http_proxy="http://username:password@host:port"
export https_proxy="http://username:password@host:port"

# npm keeps its own settings
npm config set proxy "http://username:password@host:port"
npm config set https-proxy "http://username:password@host:port"

If the password contains @ or :, URL-encode it first. Unencoded special characters are a common reason npm returns 407 even though the same proxy works in a browser. Run env | grep -i proxy to find overrides you forgot about, and unset them before testing again.

Proxy format examples

Many 407 errors are just format errors.

Use SOCKS5 vs HTTP proxy if you are unsure which protocol your tool should use. If the proxy is valid but the app expects a different layout, the proxy converter rewrites it.

Can new proxies fix a 407 error?

Buying more proxies does not fix 407 if the credentials are wrong. A 407 is usually an authentication or formatting problem.

Changing proxy providers or plans may help only when:

• The current plan expired.
• The credentials cannot be recovered.
• The provider account is disabled.
• The provider does not support the protocol your tool requires.
• The proxy list is stale or mixed with old inventory.

If the proxy authenticates correctly and the target site still blocks you, the problem has moved to the target. Debug it as a site block, and check whether your session type (sticky vs rotating) fits the workflow.

Prevention checklist

Use this checklist before loading a proxy list into production:

1. Test one proxy in cURL or a browser.
2. Confirm HTTP or SOCKS5 protocol support.
3. Convert the proxy format for the exact tool.
4. Keep credentials out of logs.
5. Avoid copying extra spaces or hidden characters.
6. Do not mix old and new proxy lists.
7. Track plan expiration and credential changes.
8. Stop workers after repeated 407 responses.
9. Separate proxy authentication errors from target-site errors.

For Unknown Proxies users, compare active plan details in the dashboard before assuming the target site is blocking the request. If you are replacing a proxy that keeps failing authentication, compare ISP plans for dedicated static IPs or residential proxies for rotating sessions, and test one proxy before moving a full workload.

FAQ

What does 407 Proxy Authentication Required mean?

It means the proxy server needs valid proxy credentials before it will forward the request to the destination. RFC 9110 defines it as similar to 401, but for the proxy instead of the target site.

Is 407 caused by the target website?

Usually no. A 407 comes from the proxy layer, and the target website often never receives the request. If the response also carries a Proxy-Authenticate header, that confirms a proxy sent it.

How do I fix 407 proxy authentication required?

Recheck the proxy username, password, host, port, protocol, plan status, and allowed IP. Test one proxy with curl -v -x "http://host:port" --proxy-user "username:password" https://example.com before retrying a full scraper.

Why does my proxy work in one tool but return 407 in another?

The second tool probably expects a different format or protocol, or it handles special characters in the password differently. Convert the proxy layout, URL-encode the password, and confirm whether the tool wants HTTP, HTTPS, or SOCKS5.

Why do I get 407 on HTTPS sites but not HTTP sites?

For HTTPS, the client sends a CONNECT request and the proxy challenges that request before TLS starts. A client that sets credentials only for http and not https sends them for plain HTTP traffic and nothing for the tunnel.

Is a SIP 407 the same error?

The idea is the same, a proxy asking a client to authenticate, but the protocol is different. A SIP 407 means the phone or trunk must authenticate with the SIP proxy, so you fix the SIP credentials, not an HTTP proxy setting.

Is 407 the same as proxy authentication error 2606?

Not necessarily. 407 is a standard HTTP status code. Proxy authentication error 2606 is an application-specific label that often points to the same credential or format problem, depending on the tool.

Final thoughts

407 Proxy Authentication Required is a proxy-layer authentication failure. Fix the proxy username, password, host, port, protocol, plan status, and tool format before debugging the target website.

Read the Proxy-Authenticate header in the 407 response, send matching credentials in Proxy-Authorization or your tool's proxy fields, and test one proxy with curl -v before you run a full list.

Technical references: MDN 407 Proxy Authentication Required, MDN Proxy-Authenticate header, Cloudflare Error 407, and RFC 9110 section 15.5.8.