Proxy Authentication

ProxyField supports both: a username and password on gate.proxyfield.io:7000, and the allowlist on the port you set up in the dashboard. Credentials and the allowlist are in your account once the payment is confirmed. The allowlist takes up to 100 IPv4 addresses per account, and one address can be on one account only.

For an HTTP or HTTPS proxy, the login travels in an HTTP header:

1. Your client sends a request to the proxy without credentials.
2. The proxy answers 407 Proxy Authentication Required with a Proxy-Authenticate header naming the scheme it accepts, usually Basic.
3. The client repeats the request with Proxy-Authorization: Basic <base64 of user:password>.
4. The proxy checks it and forwards the request. Many clients send the header on the first request and skip the 407 round trip.

The headers are defined in HTTP Semantics (RFC 9110, sections 11.7.1 and 11.7.2) and the Basic scheme in RFC 7617. Base64 is an encoding, not encryption: anyone who can read the connection between you and the proxy can read the password. For HTTPS sites the client sends the header with its CONNECT request, before the encrypted tunnel to the site starts. The website never receives your proxy credentials; the proxy consumes them.

Most tools take the login in a proxy URL or in separate fields:

curl -x http://gate.proxyfield.io:7000 -U "<login>-country-us-city-new_york:<password>" https://api.ipify.org
curl -x "http://<login>-country-us-city-new_york:<password>@gate.proxyfield.io:7000" https://api.ipify.org

With ProxyField, the username also carries the targeting: <login>-country-us-city-new_york asks for a New York exit IP. Region, session and session time go in the same username: -region-<region>, -session-<id> and -ttl-<seconds> (30 to 129,600 seconds, 20 minutes by default), as in <login>-country-us-region-new_york-city-new_york-session-he9f2qga-ttl-600; every part after the login is optional.

SOCKS5 negotiates the login inside its own handshake rather than in HTTP headers (RFC 1928):

1. The client opens a TCP connection and lists the methods it supports: 0x00 (no authentication) and 0x02 (username/password).
2. The server picks one. A proxy that requires a login picks 0x02.
3. The client sends the username and password, each up to 255 bytes, as defined in RFC 1929.
4. The server replies with success or failure; on failure it closes the connection.

The RFC 1929 exchange is plain text, like HTTP Basic. Not every client implements it: Chrome supports no authentication method for SOCKS5 (Chromium: proxy support in Chrome), so in Chrome use an HTTP proxy, an extension, or an IP allowlist. In curl, socks5h:// also resolves the site's hostname at the proxy. ProxyField's gateway takes the SOCKS5 login on the same host and port as HTTP:

curl -x "socks5h://<login>-country-us-city-new_york:<password>@gate.proxyfield.io:7000" https://api.ipify.org

SOCKS5 runs on the same gate.proxyfield.io:7000 with the same username and password; with the IP allowlist, SOCKS5 works too, on the port you set up in the dashboard.

With an allowlist, the proxy looks at the public IP each connection comes from and admits it if that IP is on your list. You send no credentials at all, so the proxy setting is just a host and a port.

To set it up:

1. Find the public IP of the machine that will use the proxy: run curl https://api.ipify.org on it, without a proxy. On a home network this is your router's IP, shared by every device behind it.
2. Add that IP to the allowlist in your ProxyField account.
3. Point the tool at gate.proxyfield.io and the port you set up in the dashboard, with no username or password. With the IP allowlist, you connect to the port you set up in the dashboard instead of 7000; the product, location and session are set per port there.

The catch is that many home and mobile connections get a new public IP from time to time, and cloud CI runners use a different IP on each run. When the IP changes, connections fail until you update the list. Allowlisting suits servers and offices with a fixed IP.

• Username and password if you move between networks, run scripts on machines whose IP changes, or want to set the country, city and session in the login.
• IP whitelist if the tool has no login fields (the Windows system proxy, a PAC file, some apps and consoles), if a browser keeps asking for the password, or if you don't want credentials stored in code.
• Both on one account, for different tools: for example the allowlist on a fixed-IP server and a username and password on your laptop.

In Python, keep the password out of the code by reading it from the environment:

import os
import requests

user = os.environ["PROXY_USER"]  # e.g. <login>-country-us-city-new_york
password = os.environ["PROXY_PASS"]
proxy = f"http://{user}:{password}@gate.proxyfield.io:7000"
r = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=30)
print(r.status_code, r.text)

In a proxy URL, @, :, /, # and % have meanings, so a password that contains them breaks the URL. Percent-encode them: @ becomes %40, : becomes %3A, / becomes %2F, # becomes %23 and % becomes %25 (RFC 3986, section 2.1). In Python, urllib.parse.quote(password, safe="") does it. Separate login fields, such as curl's -U or Playwright's password, take the password as it is.

• Store them in environment variables or your platform's secret store, not in code, and never commit them to git.
• Avoid typing them on the command line where shell history keeps them; read them from a variable or a config file with tight permissions.
• Keep the IP allowlist to the machines that need it. On ProxyField one login serves the whole account, so treat a leaked password as exposing the whole balance.
• If credentials leak, change the proxy password in your account and update your tools.

A wrong or missing login, or a connection from an IP that isn't on the allowlist, typically ends in 407 Proxy Authentication Required on HTTP proxies and a closed connection on SOCKS5. The 407 error guide lists the causes in order, and the proxy checker tests a login before you put it in a tool.