cURL with Proxy: -x, -U, SOCKS5 and No-Proxy Examples

What to look for in any rotating gateway you script with curl, and what ProxyField has:

From the dashboard to the first curl call:

1. In your account, copy the login and password, or add your server's IP to the allowlist and use the port you set up in the dashboard.
2. Generate lines in the configurator if your tool wants a list: it makes as many proxy lines as you need, all on gate.proxyfield.io:7000.
3. Run the command below twice, then watch usage and the remaining gigabytes in the dashboard, which update in real time.

What "a new IP on every request" means for curl: each curl process that connects to the gateway gets a new exit IP, so one process per request (as in the loops below) rotates on every call; the same session id in the username keeps one IP until its ttl ends. Several URLs in one curl call can reuse one connection, and an open HTTPS connection keeps one exit IP until it closes.

Run the same command twice and you get two exit IPs:

curl -s -x http://gate.proxyfield.io:7000 -U "<login>:<password>" https://api.ipify.org; echo
curl -s -x http://gate.proxyfield.io:7000 -U "<login>:<password>" https://api.ipify.org; echo

203.0.113.24
198.51.100.73

(Example output: your IPs will differ.) For a list of URLs, run several curl processes in parallel; each request leaves from a new IP, and --retry 3 repeats a request on a timeout or an HTTP 408, 429, 500, 502, 503 or 504, waiting 1 s and then doubling the wait:

export PROXY_AUTH="<login>:<password>"
xargs -P 8 -n 1 sh -c 'curl -sS -x http://gate.proxyfield.io:7000 -U "$PROXY_AUTH" --retry 3 \
  -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -H "Accept-Language: en-US,en;q=0.9" \
  -o /dev/null -w "%{http_code} %{time_total}s $1\n" "$1"' _ < urls.txt

Each line of output is the status code, the time and the URL, so 403 and 429 show at a glance.

When a login or a multi-step flow must keep one IP, add a sticky session to the username: session-<id> names it and ttl-<seconds> sets its length, 30 to 129,600 s (30 s to 36 h). Run this three times and you get the same IP three times:

for i in 1 2 3; do
  curl -s -x gate.proxyfield.io:7000 \
    -U "<login>-country-us-city-new_york-session-he9f2qga-ttl-600:<password>" https://api.ipify.org; echo
done

203.0.113.24
203.0.113.24
203.0.113.24

(Example output.) A session set without ttl lasts 20 minutes. An IP that is idle for 120 s gets a new IP, and the IP is held while its exit node is up; if the node drops, the gateway retries once with a new session, so the IP may change, and curl must reconnect. For a new IP per job, change the session id.

Without constant blocks? No gateway promises that: the IP rotates, but headers, the TLS fingerprint and the request rate still decide many blocks (section 11). Measure it on your own target instead. On the Easy Trial (1 GB for $2.95), send 100 requests and count the status codes:

seq 100 | xargs -P 8 -I{} curl -s -o /dev/null -x http://gate.proxyfield.io:7000 -U "$PROXY_AUTH" \
  -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -w "%{http_code}\n" "https://example.com/" | sort | uniq -c

The output is one line per status code, the count first and the code second; a high count of 403 or 429 means the target needs slower pacing, browser headers or a real browser.

When one request gets a 403 or 429, retry it from a new IP by changing the session id, and wait longer each time:

url="https://example.com/page"
for attempt in 1 2 3; do
  sid=$(openssl rand -hex 4)
  code=$(curl -s -o page.html -w "%{http_code}" -x http://gate.proxyfield.io:7000 \
    -U "<login>-country-us-session-$sid-ttl-60:<password>" "$url")
  echo "attempt $attempt, session $sid: $code"
  case "$code" in 403|429) sleep $((attempt * 5)) ;; *) break ;; esac
done

attempt 1, session 8ccc4352: 429
attempt 2, session 5f0da4e4: 429
attempt 3, session c8735652: 200

(Example output.) On a server, IP allowlist access drops -U: add the server's IP in your account, then call curl -x http://gate.proxyfield.io:<port> https://api.ipify.org with a port you set up in the dashboard. Without a username, the product, location and session are set per port in the dashboard. A 403 from a Cloudflare-protected site is covered in Cloudflare 403 Forbidden.

Or use the dedicated options, with --socks5-basic to state the method explicitly:

curl --socks5-hostname gate.proxyfield.io:7000 --socks5-basic --proxy-user "<login>:<password>" https://api.ipify.org

The man page's other form, --socks5, resolves the hostname on your machine and sends the proxy only the IP:

curl --socks5 gate.proxyfield.io:7000 -U "<login>:<password>" https://api.ipify.org

With -v it prints SOCKS5 connect to <ip>:443 (locally resolved), and a name your own machine cannot resolve fails before the proxy sees it: curl: (97) Could not resolve host: <name>. Prefer socks5h unless you want local DNS.

Give only the login and curl asks for the password, so it stays out of your shell history and the process list:

curl -x socks5h://gate.proxyfield.io:7000 --proxy-user "<login>" https://api.ipify.org

Enter proxy password for user '<login>':

With IP allowlist access there are no credentials to pass: once your IP is on the list in your account, drop --proxy-user and connect to the port you set up in the dashboard for that IP (<port> below):

curl -x socks5h://gate.proxyfield.io:<port> https://api.ipify.org

In a script, where nobody types a password, feed it to curl as a config line on standard input. curl hides the -U argument from process listings where the system allows it, but the man page warns that it is still visible for a brief moment before it is cleared. printf is built into the shell, so it does not show up in ps at all:

printf 'proxy-user = "<login>:<password>"\n' | curl -K - -x socks5h://gate.proxyfield.io:7000 https://api.ipify.org

curl runs SOCKS5 as defined in RFC 1928, and the username/password step as defined in RFC 1929. RFC 1929 sends the username and password to the proxy unencrypted, so anyone who can read the network path between you and the proxy can read them; on a network you do not trust, use the IP allowlist instead of a password. With -v, a working handshake shows these lines (curl 8.5.0, local test proxy; the host and port are the ones you pass):

* Connected to gate.proxyfield.io (...) port 7000
* SOCKS5 connect to api.ipify.org:443 (remotely resolved)
* SOCKS5 request granted.

A working call prints the exit IP, one line such as 203.0.113.24. What the failures look like:

curl: (97) User was rejected by the SOCKS5 server (1 1).
curl: (7) Failed to connect to gate.proxyfield.io port 7000 after 0 ms: Couldn't connect to server

curl prints the first when a SOCKS5 server answers the RFC 1929 login step with a failure, that is, it rejected the username or password; the second means a wrong host, port or a firewall. URL-encode @ and : in the password only in the socks5h://<login>:<password>@... form; with --proxy-user there is nothing to encode.

Use socks5h. The option semantics are in the curl man page. SOCKS5 takes the same username and password. When to pick SOCKS5 over HTTP is covered on the SOCKS5 proxies page.

export https_proxy="http://<login>:<password>@gate.proxyfield.io:7000"
export http_proxy="http://<login>:<password>@gate.proxyfield.io:7000"

# ~/.curlrc  (_curlrc in %APPDATA% or your home folder on Windows)
proxy = "http://gate.proxyfield.io:7000"
proxy-user = "<login>:<password>"
noproxy = "localhost,127.0.0.1"

The same file for SOCKS5:

# ~/.curlrc, SOCKS5 with remote DNS
proxy = "socks5h://gate.proxyfield.io:7000"
proxy-user = "<login>:<password>"

The same file with a US exit IP held for 10 minutes: the targeting and the sticky session go in the username, so every curl call leaves from the same IP until the session ends:

# ~/.curlrc, sticky US session
proxy = "http://gate.proxyfield.io:7000"
proxy-user = "<login>-country-us-session-abc123-ttl-600:<password>"

Run chmod 600 ~/.curlrc so other users cannot read the password. To use the proxy in one project only, and not for every curl call on the machine, define a shell function instead of a global .curlrc:

export PROXY_AUTH="<login>-country-us:<password>"
pcurl() { curl -x http://gate.proxyfield.io:7000 -U "$PROXY_AUTH" "$@"; }
pcurl -s https://api.ipify.org

pcurl takes every curl option, and plain curl stays direct.

Which file is curl reading? On Linux and macOS it takes the first it finds: $CURL_HOME/.curlrc, then $XDG_CONFIG_HOME/curlrc ("Added in 7.73.0", the man page notes), then ~/.curlrc. To see which proxy a run picked up, add -v. The Windows list is longer and is in the curl man page under -K.

For SOCKS5 on every call:

export ALL_PROXY="socks5h://<login>:<password>@gate.proxyfield.io:7000"

In ~/.curlrc, long option names go without the leading dashes, the separator is =, : or a space, and a line that starts with # is a comment. On Linux, add the export lines to ~/.bashrc to keep them in new terminals. On Windows, use set HTTPS_PROXY=http://<login>:<password>@gate.proxyfield.io:7000 in Command Prompt or $env:HTTPS_PROXY="http://<login>:<password>@gate.proxyfield.io:7000" in PowerShell. For system-wide settings on a Mac, see Mac proxy settings. The variables and the config file are described in the curl tutorial.

The verbose output also shows the Proxy-Authorization header, your credentials in Base64: remove it before sharing a log.

The messages below are curl's own, the same for any proxy; ProxyField's own gateway responses are in the line under the table.

Gateway responses: 407 Proxy Authentication Required for a wrong login or password, an IP not on the allowlist or a malformed location, 402 Payment Required when no traffic is left and 502 Bad Gateway when no exit could be connected; a restricted site gets no separate response, and a 403 comes from the site itself. See proxy errors.