HTTP 407 Proxy Authentication Required – What It Means and How to Fix It

Learn what HTTP 407 means, how proxy authentication differs from 401, which header carries the credential, and the misconfigurations that cause it.

A 407 comes from the proxy, not the destination. It says the proxy will not forward the request until you authenticate to it.

1. What Does HTTP 407 Mean?

The intermediary requires credentials of its own.

• The origin was never contacted. The request stopped at the proxy.
• A different header is involved. Proxy-Authorization, not Authorization.
• The challenge names the scheme in Proxy-Authenticate.

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="proxy"

2. HTTP 407 Versus 401

Sending destination credentials in Authorization does nothing for a 407, which is the most common source of confusion.

3. Common Causes

• Credentials omitted from the proxy URL or client configuration.
• Wrong credential format. Many providers encode session, country, or sticky-session parameters into the username; a malformed string authenticates nothing.
• Special characters unencoded. A password containing @ or : breaks a user:pass@host URL unless percent-encoded.
• Credentials on the wrong hop. Passing them to the destination rather than the proxy.
• Expired or rotated credentials on the provider's side.
• Address not allow-listed, where the provider authenticates by source address instead of by password.

4. How to Diagnose It

curl -sv -x "http://user:[email protected]:8000" https://example.com/ 2>&1 | head -20

The verbose output shows whether the proxy accepted the credential. If it still challenges, compare the username string character by character against the provider's documented format — session and country parameters are usually embedded there.

5. How to Fix It

• Put credentials in the proxy configuration, not the request's Authorization header.
• Percent-encode any reserved characters in the username or password.
• Match the provider's exact username format, including session and geography tokens.
• Confirm the credential has not been rotated, and whether the account uses address allow-listing instead.
• Ensure the client library actually supports proxy authentication for the scheme in use — some handle HTTP proxies but not HTTPS tunnels.

6. A Note on Handling

The proxy URL contains a secret. It should live in environment configuration or a secret manager, never in code, logs, or error messages. Redact it before printing any failed-request diagnostics, because proxy URLs are among the most commonly leaked credentials in scraping code.

7. Real-World Examples

• A password containing @ breaking URL parsing so the host is misread.
• A sticky-session token omitted from the username, rejected by a provider expecting it.
• A library sending Authorization instead of Proxy-Authorization on a tunnelled connection.
• A rotated credential still deployed in one worker while others were updated.

8. Summary

HTTP 407 is the proxy asking for its own credentials, carried in Proxy-Authorization and challenged with Proxy-Authenticate. The origin is never reached.

Fix it by supplying correctly formatted, properly encoded proxy credentials in the client's proxy configuration — and treat that URL as a secret in logs and diagnostics.

Potential Related Glossary

• IP Rotation
• Residential Proxies
• Axios
• Parsing