What to change
- Copy the username and password again from your account; look for spaces and line breaks.
- Check the location part: lowercase, underscores for spaces, a two-letter country code (
city-new_york,country-gb). - Inside a proxy URL, percent-encode special characters in the password, or use the tool's separate login fields.
- With the allowlist, add the current public IP of the machine that sends the requests and use the port you set up in the dashboard.
- Run one request with
-vand read the status line and text.
The test, with the login in curl's -U option:
curl -v -x gate.proxyfield.io:7000 -U "<login>-country-us-city-new_york:<password>" https://api.ipify.orgWhat a 407 means in general: 407 Proxy Authentication Required (MDN).
On this page 7 sections
What does 407 Proxy Authentication Required mean?
407 is the proxy's version of 401 Unauthorized. RFC 9110, section 15.5.8 says it "is similar to 401 (Unauthorized), but it indicates that the client needs to authenticate itself in order to use a proxy for this request". The proxy sends a Proxy-Authenticate header that names the scheme it wants, and the client answers with a Proxy-Authorization header (RFC 9110, section 11.7). Most proxy services use the Basic scheme: the username and password, Base64-encoded.
Three points help you read it:
- It comes from the proxy. The request never reached the website, so the site has not blocked you.
- It is about access to the proxy, not the target. Changing headers, user agents or the target URL does not fix it.
- For HTTPS targets it arrives during
CONNECT. Your client asks the proxy to open a tunnel, and the proxy answers 407 before any TLS starts. That is why clients report it as a tunnel or proxy error rather than an HTTP response.
What causes a 407 error?
| Cause | How it shows | Fix |
|---|---|---|
| No credentials sent | 407 on the first request; the tool never asked for a login | Put <login>:<password>@ in the proxy URL or fill the proxy login fields |
| Wrong username or password | 407 on every request | Copy both again from your account; check for spaces and line breaks |
| Special characters not encoded | Works in one tool, 407 in another | Percent-encode @ : / # ? % in the URL form |
| IP allowlist used, but your IP changed | 407 after a network change, or only on a server | Add the current IP, or switch to username and password |
| Credentials dropped for HTTPS | HTTP sites load, HTTPS sites fail with 407 | Use a client that sends Proxy-Authorization on CONNECT (most do with the URL form) |
| Unsupported auth scheme | The proxy wants Basic; the client offers only NTLM or nothing | Set the client to Basic auth |
| Location in the username malformed | 407 with the right login and password | Write the keys lowercase with _ for spaces, as in <login>-country-us-city-new_; on ProxyField no traffic left is a 402, not a 407 |
On ProxyField, the gateway answers 407 Proxy Authentication Required for wrong credentials, an IP that is not on the allowlist and a malformed location in the username, with the text ProxyField: wrong login or password, or this IP is not in the whitelist. With no traffic left it answers 402 Payment Required instead, with the text ProxyField: no traffic left. Top up at https://proxyfield.io.
How to fix proxy error 407
Test the credentials alone with cURL. This command sends one request through the gateway and prints your exit IP; use the username and password from your account.
curl -x gate.proxyfield.io:7000 -U "<login>-country-us-city-new_york:<password>" https://api.ipify.orgAn IP address back means the credentials work and the problem is your other tool's configuration. A 407 here means the credentials or the allowlist are wrong. Depending on its version, cURL reports it as
CONNECT tunnel failed, response 407orReceived HTTP code 407 from proxy after CONNECT.Copy the username and password again. Targeting options such as country and city are part of the username (
<login>-country-us-city-new_york), so a typo in a targeting value changes the username. A malformed location gets407 Proxy Authentication Required; a well-formed location where no exit could be connected gets502 Bad Gateway.Percent-encode special characters. In a URL like
http://<login>:<password>@host:port, characters such as@,:,/,#and%in the password break parsing. Encode them (for example,@becomes%40) or use the client's separate username and password fields.Check the allowlist. If you authenticate by IP, add the public IP of the machine that sends the requests, and connect to the port you set up in the dashboard, not 7000. A server, a CI runner or a laptop on a new network each has its own IP. Or switch that machine to username and password.
Make sure HTTPS requests carry the credentials. Set the same proxy URL with credentials for both
httpandhttpsin your client.Check the account. The dashboard shows real-time usage and remaining gigabytes, and access opens once a payment is confirmed. For anything else, our 24/7 live chat helps with setup and integration.
The full comparison of the two login methods is on proxy authentication: username and password vs IP whitelist.
Fix 407 in Python, Node.js and browsers
Python requests. Put the credentials in the proxy URL for both schemes, and quote special characters:
from urllib.parse import quote
import requests
user = quote("<login>-country-us-city-new_york", safe="")
password = quote("<password>", safe="")
proxy = f"http://{user}:{password}@gate.proxyfield.io:7000"
r = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=30)
print(r.status_code, r.text)If requests raises ProxyError with "Tunnel connection failed: 407 Proxy Authentication Required", the proxy rejected the credentials on the HTTPS tunnel. More on Python setups: proxies in Python and Python requests.
Node.js. Pass the credentials in the proxy URL to your proxy agent; setups for common libraries are on the Node.js proxy page.
Browsers. Chrome and most browsers have no fields for a proxy password in their proxy settings: they show a login prompt when the proxy answers 407, and some extensions store the credentials for you. If the prompt keeps coming back, the credentials are wrong or the browser is not sending them. Setup: Chrome, Firefox. Postman has its own proxy auth fields (Postman).
Phones and tablets. On an iPhone or iPad, the manual Wi-Fi proxy settings have an Authentication switch with username and password fields; a "Proxy authentication required" prompt that keeps coming back means the saved login is wrong or missing there. Android's Wi-Fi proxy settings have no login fields, so use the IP allowlist or an app that supports proxy logins. Setup steps: Android, proxy settings on any device.
407 vs 401 vs 403
| Code | Who refuses | What it wants |
|---|---|---|
| 401 Unauthorized | The website | Your login for the site |
| 407 Proxy Authentication Required | The proxy | Your login for the proxy |
| 403 Forbidden | The website (or a proxy that blocks the target) | Nothing you can send fixes it directly; the request itself is refused |
If you get a 403 after fixing the 407, the proxy now works and the site is refusing you: see 403 Forbidden when scraping.
Prevent 407 errors
- Keep credentials in environment variables or a secrets store, not pasted into many scripts.
- Prefer username and password on machines whose IP changes (laptops, CI runners, cloud functions); use the allowlist for fixed servers.
- Test new credentials with the cURL command above before a long run, or with the proxy checker.
HTTP Error 407 Proxy Authentication Required FAQ
What does proxy error 407 mean, and how do I fix it?
ProxyField proxies start at $1.95/GB and take a username and password or an IP allowlist, and proxy error 407 means the proxy did not get valid credentials from your client. To fix it, copy the username and password from your account into the proxy URL or login fields, percent-encode special characters, or add your current IP to the allowlist, then test with one cURL request.
What does "proxy authentication required" mean?
The proxy server wants a login before it forwards your traffic, and your device or tool did not send a valid one. The website has not seen your request yet.
Why do I keep getting "proxy authentication required" on my iPad?
The Wi-Fi network's manual proxy settings point to a proxy that needs a login, and the saved username or password is missing or wrong. Open the Wi-Fi network's settings, find Configure Proxy, and turn on Authentication with the right login, or switch the proxy off if you didn't mean to use one.
Why does a tool keep asking for a proxy username and password?
Each prompt is a 407 answer: the proxy rejected what the tool sent, or the tool sent nothing. Re-enter the credentials, check for special characters, or use IP allowlisting so the tool doesn't need a login.
Why can a 407 error appear even when the username and password are correct?
Usually because they never reach the proxy intact: unencoded special characters break the proxy URL, the client sends them for HTTP but not for HTTPS tunnels, or it offers an auth scheme the proxy doesn't accept. An allowlist that no longer matches your IP gives the same result.
Why do I get 407 only for HTTPS sites?
For HTTPS your client first sends CONNECT to open a tunnel, and some clients leave the proxy credentials off that request. Set the proxy URL with credentials for both http and https, or use a client that sends Proxy-Authorization on CONNECT.
What is the difference between 401 and 407?
A 401 comes from the website and asks for your login to the site. A 407 comes from the proxy and asks for your login to the proxy.
Does a 407 error mean the website blocked me?
No. The proxy stopped the request before it reached the website, so the site has not seen it. Fix the proxy login first; if a 403 follows, that one comes from the site.
What does "received HTTP code 407 from proxy after CONNECT" mean?
cURL asked the proxy to open an HTTPS tunnel and the proxy refused it for lack of valid credentials. Check the -U user:pass value, or the credentials in the proxy URL, and quote them in the shell.
Does clearing the browser cache fix error 407?
Rarely. A 407 is about the proxy login, so re-enter the proxy credentials or remove a saved wrong login; clearing the cache only helps if the browser keeps replaying an old, wrong login.
Show 2 more questionsShow fewer questions
Can a SOCKS5 proxy return HTTP 407?
No, 407 is an HTTP status, so only HTTP and HTTPS proxies send it. A SOCKS5 proxy rejects a bad login in its own handshake, and your client reports that as a SOCKS authentication or connection error.
How do I prevent 407 errors?
Keep the credentials in one place, such as an environment variable, and test them with one request before a long run. Use username and password on machines whose IP changes, and the IP allowlist only on servers with a fixed IP.