What Is Proxy Authentication? – Definition and How It Works
Learn how proxies authenticate clients, how credential-encoded parameters work, why the URL is a secret, and how to diagnose a 407.
Proxy authentication identifies who is using a proxy. It is separate from any authentication at the destination, uses different headers, and fails with a different status code.
1. The Two Methods
Credential-based — a username and password supplied by the client, carried in Proxy-Authorization. Works from anywhere.
Address-based — the provider allows a set of source addresses and requires no credential. Simpler, and only workable when your egress address is stable.
Most providers support both, and address-based access is convenient until a cloud egress address changes without notice.
2. How Credentials Travel
CONNECT example.com:443 HTTP/1.1
Proxy-Authorization: Basic dXNlcjpwYXNz
Note the header: Proxy-Authorization, not Authorization. Sending destination credentials in the latter does nothing for a proxy challenge, which is the most common source of confusion.
3. Parameters Encoded in the Username
Providers commonly express routing policy through the username rather than through extra fields:
user-session-a1b2-country-us-city-austin:[email protected]:7000
Session identifiers hold an exit, country and city codes pin geography, and other tokens select pool characteristics. A malformed string authenticates nothing, and the resulting error is usually a generic refusal rather than a helpful message.
4. Encoding Matters
A password containing reserved characters — @, :, /, # — breaks URL parsing unless percent-encoded. The symptom is confusing: the client attempts to connect to the wrong host, because the parser split the URL at the wrong character.
5. Diagnosing a 407
407 Proxy Authentication Required means the proxy refused for credentials.
- Confirm credentials are configured on the proxy, not sent to the destination.
- Compare the username string character by character against the provider's documented format.
- Percent-encode reserved characters.
- Check whether the account uses address allow-listing instead.
- Confirm the credential has not been rotated.
6. The Proxy URL Is a Secret
It contains a working credential. It must live in environment configuration or a secret manager, and must be redacted before any diagnostic output reaches a log, an error tracker, or an issue.
Proxy URLs are among the most frequently leaked secrets in collection code, precisely because they appear in the natural place to log — the failing request.
7. Rotation
Credentials should be rotatable without downtime, which requires the provider to allow more than one active credential: issue the new one, deploy it, confirm traffic moved, then revoke the old.
Where only one credential exists, rotation is an outage, so plan the window.
8. Summary
Proxy authentication uses Proxy-Authorization, challenged with 407, and is entirely separate from destination authentication. Many providers encode session and geography parameters into the username.
Percent-encode reserved characters, match the documented format exactly, treat the whole proxy URL as a secret, and redact it from every log and error report.