How to Fix HTTP Error 407 (Proxy Authentication Required): A Step-by-Step Guide for Users, Developers and Admins

You open a website, send an API request, or run a scraper. Then it stops. The message reads: HTTP Error 407: Proxy Authentication Required. 😤

Take a breath. The website is usually fine. The server is not down. The block happens earlier, at a proxy server that wants to see your login first.

In this guide, you will learn what HTTP error 407 means, why it happens, and how to fix it fast. 🛠️ We cover fixes for everyday users, developers, and IT administrators. We also include tested code for Python, Node.js, Java, and cURL.

⚡ Key Takeaways (Quick Summary)

• Core cause: A proxy server between you and the website blocked your request. It needs valid credentials (username and password) first.
• 407 vs 401 vs 403: 401 means the destination site needs a login. 403 means access is forbidden. 407 means the proxy needs authentication.
• Quick fix for regular users: Re-enter your proxy login, clear old saved credentials, and turn off proxy extensions or VPNs you do not need.
• Quick fix for developers: Send credentials to the proxy in the format http://username:password@proxy_address:port. URL-encode special characters in the password (for example, @ becomes %40).
• Correct password, still 407? Check the auth scheme (Basic, NTLM, Kerberos), IP whitelisting, and the proxy port. Java users should also check the Basic-auth tunneling restriction.

🔍 What Is HTTP Error 407 and How Does It Work?

The HTTP 407 Proxy Authentication Required status code is a client error. It sits in the 4xx family. It means the request failed because it lacked valid credentials for a proxy server.

That proxy sits between your device and the target website or API. It filters, logs, or secures outbound traffic. No valid login? It stops your request on the spot. 🚧

⚙️ Under the Hood: How the 407 Handshake Works

Knowing the mechanism makes troubleshooting much easier. Here is the typical flow:

1. The request: Your client sends a request to the proxy. For HTTPS sites, this is a CONNECT request that asks the proxy to open a tunnel.
2. The 407 challenge: The proxy finds missing or wrong credentials. It replies with 407 Proxy Authentication Required and a Proxy-Authenticate header. That header names the auth scheme it accepts, such as Basic, Digest, NTLM, or Negotiate.
3. The authenticated retry: Your client sends the request again. This time it adds a Proxy-Authorization header with your credentials.

Here is what the challenge looks like on the wire:

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="Access to internal site"

And here is the retry with credentials:

GET http://example.com/ HTTP/1.1
Host: example.com
Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==

💡 Many clients skip the first step. They send Proxy-Authorization right away when you supply credentials. A 407 then means the proxy rejected what you sent.

For more detail, see the official MDN documentation for 407.

⚖️ HTTP 407 vs 401 vs 403: Key Differences

People often mix up these three codes. They all deal with access. But they come from different places. Here is how they compare:

Remember this rule: 401 and 403 come from the website. 407 comes from the proxy. 🧠

🧾 Common HTTP 407 Error Messages by Tool

The same problem shows up under different names. Match your message below:

Next, let us look at what triggers the error.

🕵️ Why Does HTTP Error 407 Happen? (Common Causes)

Several issues can trigger an unexpected 407:

• 🔑 Wrong or expired credentials: You typed the wrong proxy username or password. Or your domain password expired, or the account was disabled.
• 🗂️ Stale cached credentials: You changed your password, but your system or browser keeps sending the old one.
• 🧩 Missing authentication in code or tools: You set the proxy host and port in a script or tool (Python, Java, Node.js, Postman, cURL) but forgot the username and password.
• 🏢 Corporate or VPN-enforced proxy: Your network policy, VPN, or proxy auto-config (PAC) file routes traffic through an authenticating proxy. Your app is not set up to log in to it.
• 🔐 Auth scheme mismatch: Your client sends Basic credentials. The proxy requires NTLM or Kerberos. Or the reverse.
• 🔣 Unencoded special characters: A password with @, :, /, #, or % breaks the proxy URL.
• 🌐 IP whitelist mismatch: Some proxy providers authorize by IP address. If your IP changes, the proxy returns 407 until you update the whitelist.
• 🚪 Wrong proxy endpoint or port: You used the wrong port. Or you used an HTTP proxy address with a SOCKS client (or the other way around).
• 💳 Inactive account or plan: With paid proxies, an expired plan, used-up traffic, or a suspended account can end in an authentication failure.
• ✂️ Stripped headers: A firewall or a second proxy in the chain drops the Proxy-Authorization header before it reaches the proxy that checks it.
• ☕ Java restrictions: Since Java 8u111, Basic authentication is disabled by default for HTTPS tunneling.

Now let us fix it. Pick the section that matches your role. 👇

🔧 How to Fix HTTP Error 407 (By Role)

👤 Scenario 1: Fixes for Regular Users and Desktop Browsers

If your browser or desktop app shows a 407, try these steps in order.

1. Re-enter your proxy credentials

When the proxy asks you to log in, type your username and password again. Go slowly. On a corporate network, use the right format. Examples: DOMAIN\Username or [email protected]. Ask your IT team which one applies.

2. Clear cached credentials

Old saved logins often cause repeated 407 errors. This is common right after a password change.

On Windows:

1. Press Windows + S, search for Credential Manager, and open it.
2. Click Windows Credentials.
3. Find entries that match your proxy address or company domain.
4. Expand the entry and click Remove.
5. Close all browser windows, reopen the browser, and sign in again.

On macOS:

1. Press Cmd + Space, search for Keychain Access, and press Enter.
2. Search for your proxy name or IP address.
3. Right-click the matching entry and choose Delete.
4. Quit and relaunch your browser, then enter your new login.

📝 No entry found? That is fine. Some browsers hold proxy logins in memory only. A full browser restart clears them.

3. Check your OS and browser proxy settings

Make sure your system does not point to a proxy you no longer use:

• Windows: Settings > Network & internet > Proxy. Turn off manual proxy setup if you do not need it.
• macOS: System Settings > Network, select your connection, click Details, then open Proxies.
• Browser: Chrome and Edge use your system proxy settings. Firefox has its own under Settings > General > Network Settings.

4. Disable proxy extensions and VPNs

Extensions like Proxy SwitchyOmega and some VPN clients can override your settings. Turn them off, then test again. ✅

5. Ask IT for help or a bypass rule

On a work network? Contact your IT team. They can confirm your account is active. They can also add the site you need to the proxy's bypass list or authentication exceptions, so no login is needed for it.

💡 Pro tip for special characters: If your password contains @, :, or /, tools may read your proxy URL wrongly. URL-encode the password. For example, P@ssword! becomes P%40ssword%21.

👩‍💻 Scenario 2: Fixes for Developers and Engineering Teams

If your code, scraper, or API client gets a 407, start here.

1. Test the proxy with cURL first

Take your code out of the picture. Test the proxy from the terminal:

curl -v -x http://proxy.example.com:8080 -U 'username:password' https://example.com

The -U flag (long form --proxy-user) sends proxy credentials. You do not need to URL-encode the password with this flag. ✅

You can also embed the credentials in the proxy URL. Here you must URL-encode special characters:

curl -v -x 'http://username:p%[email protected]:8080' https://example.com

cURL works but your code fails? The problem is in your application setup. cURL fails too? Check the credentials, the proxy address, the port, and the auth scheme.

2. Configure proxy authentication in code

Here is how to set up authenticated proxies in popular languages. Replace the example host, port, and credentials with your own.

Python (Requests)

Build the proxy URL with URL-encoded credentials. Add a timeout so your script never hangs:

import requests
from urllib.parse import quote

user = quote("your_username", safe="")
password = quote("your_p@ssword!", safe="")
proxy_url = f"http://{user}:{password}@proxy.example.com:8080"

proxies = {
    "http": proxy_url,
    "https": proxy_url,  # still an http:// URL: it is the proxy's own address
}

try:
    response = requests.get("https://example.com", proxies=proxies, timeout=15)
    print(f"Status Code: {response.status_code}")
except requests.exceptions.ProxyError as e:
    print(f"Proxy Error: {e}")
except requests.exceptions.RequestException as e:
    print(f"Request Error: {e}")

📌 For HTTPS sites, a 407 usually raises a ProxyError. You will not get a normal response object. For plain HTTP sites, check response.status_code == 407.

Python (aiohttp)

aiohttp does not use a proxies dictionary. Pass one proxy URL instead:

import asyncio
import aiohttp
from urllib.parse import quote

user = quote("your_username", safe="")
password = quote("your_p@ssword!", safe="")
proxy_url = f"http://{user}:{password}@proxy.example.com:8080"

async def main():
    timeout = aiohttp.ClientTimeout(total=15)
    async with aiohttp.ClientSession(timeout=timeout) as session:
        async with session.get("https://example.com", proxy=proxy_url) as resp:
            print(f"Status Code: {resp.status}")

asyncio.run(main())

Node.js (Axios and https-proxy-agent)

Install the packages first: npm install axios https-proxy-agent. Then pass an agent to Axios. Set proxy: false so Axios does not apply its own proxy handling on top:

const axios = require('axios');
const { HttpsProxyAgent } = require('https-proxy-agent');

const user = encodeURIComponent('your_username');
const password = encodeURIComponent('your_p@ssword!');
const agent = new HttpsProxyAgent(`http://${user}:${password}@proxy.example.com:8080`);

axios.get('https://example.com', { httpsAgent: agent, proxy: false, timeout: 15000 })
  .then(response => {
    console.log(`Status Code: ${response.status}`);
  })
  .catch(error => {
    console.error(`Error: ${error.response ? error.response.status : error.message}`);
  });

🔎 This example uses the named import { HttpsProxyAgent }, which current versions of the package export.

Java (java.net.http.HttpClient)

Two things trip people up in Java. First, you must set the proxy and the authenticator on the client builder. Calling Authenticator.setDefault() alone does not set a proxy. Second, Basic auth is disabled by default for HTTPS tunneling. Re-enable it before you create the client:

import java.net.Authenticator;
import java.net.InetSocketAddress;
import java.net.PasswordAuthentication;
import java.net.ProxySelector;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class ProxyExample {
    public static void main(String[] args) throws Exception {
        // Re-enable Basic auth for HTTPS tunneling (disabled by default since Java 8u111).
        // Set this BEFORE creating the HttpClient.
        System.setProperty("jdk.http.auth.tunneling.disabledSchemes", "");

        HttpClient client = HttpClient.newBuilder()
                .proxy(ProxySelector.of(new InetSocketAddress("proxy.example.com", 8080)))
                .authenticator(new Authenticator() {
                    @Override
                    protected PasswordAuthentication getPasswordAuthentication() {
                        if (getRequestorType() == RequestorType.PROXY) {
                            return new PasswordAuthentication("your_username", "your_password".toCharArray());
                        }
                        return null;
                    }
                })
                .build();

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://example.com"))
                .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println("Response Status: " + response.statusCode());
    }
}

You can also pass the flag at startup: -Djdk.http.auth.tunneling.disabledSchemes="". Only do this if your proxy requires Basic auth. 🔒

3. Use environment variables

Many CLI tools and runtimes read proxy settings from environment variables. The proxy URL uses http:// even for HTTPS traffic. That is normal.

Linux and macOS (bash or zsh):

export http_proxy="http://username:[email protected]:8080"
export https_proxy="http://username:[email protected]:8080"
export no_proxy="localhost,127.0.0.1,.internal.company.com"

Windows PowerShell:

$env:HTTP_PROXY = "http://username:[email protected]:8080"
$env:HTTPS_PROXY = "http://username:[email protected]:8080"
$env:NO_PROXY = "localhost,127.0.0.1,.internal.company.com"

Windows Command Prompt:

set HTTP_PROXY=http://username:[email protected]:8080
set HTTPS_PROXY=http://username:[email protected]:8080

📝 Some tools read the lowercase names. Others read uppercase. Set both if a tool ignores your settings. The no_proxy syntax also varies slightly between tools.

4. Fix 407 in common developer tools

Quick commands for tools you probably use:

# Git
git config --global http.proxy "http://username:[email protected]:8080"
git config --global http.proxyAuthMethod basic

# pip
pip install --proxy http://username:[email protected]:8080 requests

# npm
npm config set proxy http://username:[email protected]:8080
npm config set https-proxy http://username:[email protected]:8080

💡 Git showing Received HTTP code 407 from proxy after CONNECT? Setting http.proxyAuthMethod to basic fixes it for some proxies. Skip that line if your proxy needs NTLM or Kerberos.

🔒 Security note: Do not hard-code proxy passwords in source code or commit them to Git. Load them from a secrets manager or protected environment variables. Also remember that Basic auth is only Base64-encoded, not encrypted. It is not secure on an untrusted network.

🛡️ Scenario 3: Fixes for IT Administrators and DevOps Engineers

You manage proxies or server fleets? Follow these steps.

1. Check which auth scheme the proxy expects

Send a request without credentials and read the headers:

curl -v -x http://proxy.example.com:8080 https://example.com

Look for the Proxy-Authenticate header in the 407 response. A packet capture in Wireshark or a debugging proxy like Fiddler also works. Then match your client to the scheme:

Example for an NTLM proxy:

curl -v --proxy-ntlm -x http://proxy.example.com:8080 -U 'DOMAIN\username:password' https://example.com

🤔 Not sure which scheme to use? Try --proxy-anyauth. It lets cURL pick one from the proxy's offer.

2. Exempt trusted traffic from authentication

Do internal services or build pipelines hit 407? Exempt them on the proxy. Do not rely on client settings alone. Here is a Squid example:

acl internal_net src 10.0.0.0/8
acl authenticated proxy_auth REQUIRED

http_access allow internal_net
http_access allow authenticated
http_access deny all

📌 Squid reads http_access rules from top to bottom. The first match wins. Put the exemption before the authentication rule. This example also assumes you have already defined auth_param settings.

On the client side, the NO_PROXY variable tells apps to skip the proxy for certain hosts. It is a client setting. It does not change what the proxy server enforces.

3. Check for dropped headers in proxy chains

Traffic passes through more than one proxy or firewall? Confirm that Proxy-Authorization reaches the proxy that checks it. A device in the middle may strip or rewrite it.

4. Review proxy logs and policies

Look at the proxy's access logs for the failing user or IP. A proxy may also return 407 to force re-authentication when a destination is blocked by policy. Check your rules and group memberships. 🔍

🚀 Using a Paid Proxy? Avoid 407 Errors From the Start

Most 407 errors when using paid proxies come from simple configuration or authentication issues. A quick pre-flight check can save you hours of troubleshooting:

• ✅ Copy the host, port, username, and password exactly as shown in your provider dashboard.
• ✅ Match the protocol (HTTP, HTTPS, or SOCKS5) to the port you were given.
• ✅ If your plan uses IP whitelisting, update the whitelist whenever your IP changes.
• ✅ Confirm your plan is active and has traffic left.
• ✅ Test one request with cURL before you scale up your scraper or automation.

✅ HTTP 407 Troubleshooting Checklist

Before you launch your app or contact support, run through this list:

• ✅ Proxy host and port: Are the proxy address and port correct?
• ✅ Credentials: Are the username and password current and typed exactly?
• ✅ URL encoding: Are special characters such as @, #, :, /, and % encoded in the proxy URL?
• ✅ Cache check: Did you clear old saved logins and restart the browser or app?
• ✅ URL format: Does your code use http://user:pass@host:port?
• ✅ Auth scheme: Does your client support what the proxy asks for (Basic, Digest, NTLM, Kerberos)?
• ✅ IP whitelist: If the proxy authorizes by IP, is your current IP on the list?
• ✅ Java users: Did you re-enable Basic auth for HTTPS tunneling if the proxy needs it?
• ✅ Bypass rules: Should this internal URL skip the proxy through NO_PROXY or an admin exemption?

❓ HTTP Error 407 FAQ

Q1: What does HTTP error 407 mean?

It means a proxy server between you and the website requires authentication. Your request did not include valid proxy credentials, so the proxy blocked it.

Q2: Is HTTP 407 a client-side or server-side error?

It is a client-side (4xx) error. In practice, the cause is usually missing or wrong credentials or settings on the client. But a misconfigured proxy can trigger it too.

Q3: Why do I get 407 when my password is correct?

Common reasons include an unencoded special character in the password, an auth scheme mismatch (for example, NTLM versus Basic), a changed IP on an IP-whitelisted proxy, a wrong port, or an inactive account. In Java, Basic auth for HTTPS tunneling is disabled by default.

Q4: How do I fix "Received HTTP code 407 from proxy after CONNECT"?

The proxy rejected the HTTPS tunnel request. Send valid proxy credentials, for example with curl -x http://proxy:port -U user:pass. Then check the auth scheme the proxy requires. With Git, try git config --global http.proxyAuthMethod basic if your proxy uses Basic auth.

Q5: Can I just bypass the proxy to avoid 407?

Only if your network policy allows it. On a corporate network, ask IT to add your destination to the bypass list or the authentication exceptions. Do not try to work around security controls on your own.

🏁 Summary

An HTTP Error 407 (Proxy Authentication Required) message can be frustrating. But it does not mean the website is broken. You simply hit a checkpoint at a proxy server, and your request lacked valid credentials.

Update or clear saved logins. Set the proxy correctly in your code, with encoded credentials. Match the auth scheme the proxy expects. Work through the checklist above, and you can clear the error in minutes. 🎉