HTTP 407 proxy authentication required: find the failing hop

Find which hop returned the response

The proxy sends a Proxy-Authenticate challenge, and the client answers with Proxy-Authorization when it has credentials for that proxy. An origin server uses the different 401 and WWW-Authenticate pair; 403 describes a refusal by the responding server.

For an HTTPS target through an HTTP proxy, the client first requests a tunnel with CONNECT. A 407 at that step blocks the tunnel; the destination TLS session has not started. If CONNECT succeeds and the destination later returns 401 or 403, diagnose origin authentication or policy instead.

A corporate chain can contain more than one proxy. A client library can also convert a failed tunnel into an exception instead of exposing a normal target response. Match the failure to the route and endpoint that answered before rotating credentials or changing the target.

Probe one HTTPS tunnel with curl

Use curl 8.7.1, tested on macOS 26.5.2, and an approved proxy endpoint. Requests and Playwright notes below summarize their official proxy configuration; no provider route is assumed.

Use a fixed HTTPS URL and the approved proxy endpoint. This example assumes a no-auth or Internet Protocol (IP) allowlisted proxy. Set PROXY_URL to http://host:port without credentials; --noproxy '' prevents curl from bypassing that proxy because of a NO_PROXY rule. --disable ignores a local curl configuration file.

The curl --connect-timeout option limits connection setup; --max-time caps the complete transfer. The example values are diagnostic bounds.

: "${PROXY_URL:?Set PROXY_URL to an approved proxy scheme, host, and port}"

curl --disable --proxy "$PROXY_URL" --noproxy '' \
  --connect-timeout 10 --max-time 25 \
  --silent --show-error --output /dev/null \
  --write-out 'target=%{response_code} connect=%{http_connect}\n' \
  'https://example.com/'

target is the final transfer's response code; connect is the last HTTP proxy response to CONNECT, as documented by curl's write-out variables. connect=407 identifies a proxy challenge. connect=200 means that the HTTP proxy accepted the tunnel, after which the target may still return an error. A SOCKS proxy does not use HTTP CONNECT, so this field does not describe SOCKS negotiation.

For a credentialed route, use the provider's documented authentication method through the runtime's secret store or approved credential binding. Do not put a password in --proxy-user, a proxy URL, a shell variable copied into a shared environment, or a diagnostic log. If curl must prompt interactively, first confirm that its prompt behavior matches the installed curl version and that the terminal is private; do not use that method in unattended jobs.

Check Requests and Playwright

These are configuration checkpoints, not complete client programs. The runnable diagnostic above uses curl; apply each client’s documented setup separately.

In Requests, pass the proxy mapping to the request that needs it, for example {"https": "http://proxy-host:port"}. The scheme in the mapping key describes the destination request; the value describes the proxy URL. Requests documents that environment proxy settings can affect a session, so compare the effective HTTPS_PROXY, ALL_PROXY, and NO_PROXY configuration without printing values that contain credentials.

A rejected CONNECT can surface as requests.exceptions.ProxyError before Requests creates a response object. Record the exception class and route phase, then inspect an approved proxy-side connection record. Avoid logging the raw exception when it may include endpoint details.

Playwright's network documentation supports proxy credentials in browser proxy configuration. Put the username and password in the browser's supported proxy setting, loaded from a secret store at runtime. Do not add Proxy-Authorization through page JavaScript: page code targets the origin request context, while proxy authentication belongs to the intermediary.

Correct the configuration and retest

Check the proxy's advertised scheme, whether it expects a password or source-IP allowlist, the username format, account status, and endpoint-specific access. A credential accepted by one endpoint does not prove it is authorized on another.

Warning: Proxy credentials can be exposed through shell history, process inspection, traces, or logs. Limit the test to one approved proxy and target, load credentials through the approved secret binding, redact diagnostics, and rotate a credential if it was exposed.

Repeat the same fixed probe after the change. Record the client, proxy scheme, target host, CONNECT status, final target status, and timestamp. If an IP-check endpoint is used, choose a fixed endpoint operated by the team or otherwise explicitly trusted; its response shows only the address observed on that request. It does not prove the target accepts the route or that another destination will behave the same way.

If the status is missing, isolate DNS, TCP, and TLS before changing credentials. The proxy timeout guide separates those phases; the certificate error guide covers trust failures.

ProxyLaneTraffic never expires

Premium residential proxies
From $2/GB

Scale your workflows with the tools you already use. Rotating or sticky sessions up to 72 hours.

Try 350 MB for $1.95 View plans