Proxy Error 407 (Proxy Authentication Required): How to Fix It

What a 407 actually means

407 Proxy Authentication Required is an HTTP status code that a proxy server sends back when a request arrives without valid credentials. The proxy includes a Proxy-Authenticate header telling the client how to log in, and expects the next request to carry a Proxy-Authorization header. Most tools build that header for you from the username and password you give them.

The website you were trying to reach never saw the request, because the proxy stopped it first. So a 407 tells you nothing about whether the target site would accept the IP. The cause is your credentials or the way your tool sends them, and both are on your side.

407 only exists in HTTP. If you connect over SOCKS5, the same mistake shows up as a SOCKS authentication failure, and the exact wording depends on your tool. The causes and fixes below apply to both.

407 vs 401 vs 403

Each of these codes comes from a different place, so each one sends you to a different fix.

Start with a one-line test

Before changing anything in your scraper or browser, take the tool out of the picture. Send a single request with cURL using the exact host, port, username and password from your dashboard. If cURL gets through, the credentials are fine and the problem is in your tool's settings. If cURL also gets a 407, the problem is the credentials or the line itself.

Add -v to see the status line the proxy returns. Replace the placeholders with your own values, and do not paste the full command anywhere others can read it.

curl -v -x http://USERNAME:PASSWORD@PROXY_HOST:PORT https://api.ipify.org
curl -v --socks5-hostname USERNAME:PASSWORD@PROXY_HOST:PORT https://api.ipify.org

The usual causes, in the order to check them

1. 1
   You used the wrong password

   The proxy password is not the password you use to sign in to the provider's dashboard. On IPMusk, Rotating Residential uses one managed proxy username and password shown in the Residential workspace, and each Static ISP or Datacenter resource has its own connection details on its page. Changing your dashboard password does not change any proxy password.

2. 2
   A space or line break came along with the paste

   Copying from a table or an email often picks up a trailing space or a newline. The proxy then compares a password that ends in a space and rejects it. Paste into a plain text editor first and check both ends.

3. 3
   A special character broke the URL

   In the user:pass@host:port form, the characters @ : / # % have a meaning of their own. A password containing @ makes the tool think the host starts in the middle of the password. Either URL-encode those characters or enter the username and password in the tool's separate fields, which do not need encoding.

4. 4
   The fields are in the wrong order

   host:port:user:pass and user:pass@host:port are different formats. A tool that expects one will read the other as a host called USERNAME and a port called PASSWORD, or send your host as the username. Check which format your tool asks for and copy the line in that format.

5. 5
   The tool never sent the credentials

   Some setups send credentials for plain HTTP requests but not for HTTPS ones, which go through the proxy as a CONNECT tunnel. Others pick up the proxy from an environment variable that has no password in it. In both cases the proxy sees a request with no Proxy-Authorization header and answers 407.

6. 6
   You expected the proxy to recognise your IP

   Some providers let you allowlist your own IP so no password is needed. IPMusk does not offer IP allowlist authentication, so every connection must carry the username and password. Removing them because you thought your IP was approved will always end in a 407.

7. 7
   The package or resource is no longer active

   Check that your traffic package or assigned resource is still active, and that you are using the latest connection details. If a Static ISP or Datacenter proxy was replaced, the old details stop working; if support rotated your Residential credential, update it everywhere you saved the old one.

URL-encoding a password

If your password contains any of the characters below, replace each one with its encoded form when you put it inside a proxy URL. Only the password (and the username, if it has them) needs this; leave the host and port as they are.

In Python you can let the standard library do it: urllib.parse.quote(password, safe="") returns the encoded password, ready to place between the colon and the @.

Tool-specific things to check

• Python requests: set the proxy for both the http and https keys in the proxies dictionary. Setting only http leaves every HTTPS request without the proxy, or with a different one picked up from the environment.
• Environment variables: HTTP_PROXY, HTTPS_PROXY and ALL_PROXY override or fill in for settings you thought you made in code. Print them before you run the script, and remember NO_PROXY can exclude hosts entirely.
• Browsers and extensions: when the browser asks for a proxy username and password, fill it in. Dismissing that prompt makes every following request fail with 407.
• Chrome launched with --proxy-server: that flag accepts a host and port but not a username and password. Use an extension, an antidetect browser profile, or your automation tool's own proxy credential option.
• Antidetect browsers: open the profile you actually launched and check that its proxy type (HTTP or SOCKS5) and credentials match the line you copied.
• Any tool: restart it after changing proxy settings. Many read them only at start-up.

If cURL works but your tool still gets 407

In that case the credentials are good and your tool is sending something else. Compare what the tool is configured with against the cURL line character by character: protocol, host, port, username, password. Look for an old proxy saved in a second place, such as a profile setting, a config file, or an environment variable set in your shell profile.

The free proxy checker is another quick test. It accepts lines in the user:pass@host:port and host:port:user:pass formats, tests up to 20 HTTP or SOCKS5 proxies at once, and reports authentication failures separately from timeouts and dead proxies. The proxies and passwords you test are not stored.

Before you contact support

If cURL still returns 407 with credentials you copied fresh from the dashboard, open a Technical ticket. Include the time of the failure, the product, the resource ID or proxy IP, the tool you used and the exact error text.

Never include the password or a full proxy URL in a ticket, email or screenshot. Support can already see the resource you attach. If a password does end up in a ticket, ask for it to be rotated.