Fix 407 Proxy Authentication Required

Resolve HTTP 407 errors with a private curl test, the correct proxy credentials and authentication settings. Separate proxy login from website login.

Mobileproxies.orgUpdated 13 November 20264 min read

HTTP 407 means the proxy needs valid authentication for the request. Check the proxy username, password and supported authentication method. A website login or portal password is not automatically a proxy credential.

Distinguish proxy login from website login

A 407 response concerns authentication to a proxy. It includes a Proxy-Authenticate challenge describing the authentication scheme. A 401 response instead concerns authentication for the requested resource. Changing your website password does not repair a proxy login.

For an HTTPS destination reached through an HTTP proxy, authentication can fail while the client is asking the proxy to open a CONNECT tunnel. The destination page has not been fetched successfully at that point.

Compare 401, 407 and other HTTP errors

References: MDN: proxy authentication response

Verify the issued credentials

Open the active rental and compare its proxy username, password, host and port with the client configuration.
Use separate username and password fields when the client provides them. If credentials must go inside a URL, encode reserved characters in each credential component.
Check the authentication method the proxy supports. Do not assume a browser extension supports every proxy protocol and authentication combination.
Check rental expiry and any access restrictions in the service documentation. Do not assume IP allowlisting is available unless it is documented for your rental.

Create a private curl configuration

This example uses HTTP Basic proxy authentication, curl's default for proxy-user. Save the configuration outside your repository, for example at ~/.config/proxy-check.curl. On macOS or Linux, create the file with owner-only read/write permissions (600) before adding credentials in a local editor. Replace each placeholder with the issued value.

In curl configuration quoted values, escape a literal backslash as two backslashes and a literal double quote with a preceding backslash. Use the username and password as credentials, not a URL-encoded string in the proxy-user field. Keep the file out of shared folders and remove it when finished.

File permissions protect the saved password. HTTP Basic sends reusable credentials to an http:// proxy without encrypting that client-to-proxy connection, even when the destination is HTTPS. Use an https:// proxy endpoint only if your provider explicitly supports one; changing the scheme alone does not add TLS support.

curl config

# Create this file outside your project and keep it private.
# Example placeholders only. Use the details from your rental.
proxy = "http://PROXY_HOST:PROXY_PORT"
proxy-user = "PROXY_USERNAME:PROXY_PASSWORD"
noproxy = ""
connect-timeout = 10
max-time = 30
silent
show-error

References: curl proxy and configuration options

Run one request and inspect the result

The command below reports the destination HTTP status, the proxy CONNECT status and elapsed time without printing a response body. A CONNECT value of 407 identifies authentication failure during the tunnel setup. A CONNECT value of 200 only confirms that the tunnel opened; check the destination status and curl exit code as well.

Run curl with -q as its first option to ignore the default curl configuration, then load the private file explicitly. The command requests example.com without printing its response body. After the check succeeds, repeat with the application destination you are authorized to use.

Shell

# Replace the path with your private curl configuration file.
curl -q --config "$HOME/.config/proxy-check.curl" \
  --output /dev/null \
  --write-out 'http=%{http_code} connect=%{http_connect} total=%{time_total}s\n' \
  https://example.com
printf 'curl_exit=%s\n' "$?"

Do not share the configuration file, verbose traces or authentication headers. A redacted summary of status codes and timing is enough for the first support report.

References: curl proxy and configuration options

A reproduced 407 and its authentication control

We tested an HTTP Basic fixture locally on 13 November 2026 with curl 8.7.1. Without credentials it returned CONNECT 407, destination status 000 and curl exit 56. No destination connection was attempted.

With the fixture credentials, the authentication check passed. The fixture then deliberately returned CONNECT 502 instead of forwarding traffic. That control shows which result changed when authentication succeeded; it does not claim that a destination page loaded.

Shell

python3 proxy-diagnostics-lab.py --output proxy-lab-results.json

Download the local diagnostic lab

Read the recorded versions and results

If valid credentials still fail

Keep the same endpoint and test in a second client. If both return 407, contact support with the rental identifier, protocol, timestamp and authentication method. If only one fails, compare that client's credential fields and proxy settings.

Stop retrying unchanged credentials after a repeatable 407. Correct the credential or authentication setting, rerun the small test, then confirm the exit IP in the application. If the provider changed the rental details, update the affected clients together.