HTTP 407 Proxy Authentication Required: Causes and Fixes

HTTP 407 Proxy Authentication Required

HTTP 407 Proxy Authentication Required is the status a proxy returns when a request arrives without valid proxy credentials: no Proxy-Authorization header, a wrong username or password, or a source IP that is not whitelisted when whitelisting is the only method configured. It is the proxy's counterpart of 401 and means the request never left the gateway; fixing the credentials or the whitelist resolves it.

2 min read Also called 407 error, proxy authentication required Updated Oct 15, 2026

Common causes#

Credentials pasted with a trailing space or newline.
Special characters in the password not URL-encoded in a proxy URL.
The client sends credentials only after a challenge, and the tool does not handle the 407 round trip; pre-emptive Proxy-Authorization fixes it.
A rotated password: the old one expired after the grace period.
Whitelist mode with a changed source IP.

Quick check#

cURL prints the gateway answer

curl -v -x http://USER:PASS@res.hodlproxy.com:9000 https://api.ipify.org

What a 407 response looks like#

Raw response from the proxy

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="proxy"
Content-Length: 0

The proxy, not the website, sends it: the request never left the gateway. The client is expected to retry with a Proxy-Authorization header carrying valid credentials.

407 versus 401 and 403#

Code	Sent by	Means
407	The proxy	Authenticate to the proxy first
401	The website	Authenticate to the website
403	The website (or a proxy policy)	Authenticated or not, access is refused

How to fix 407 in common tools#

Tool	Fix
cURL	Put credentials in the proxy URL or use `--proxy-user user:pass`; URL-encode special characters.
Python requests	Use `http://user:pass@host:port` in `proxies`; encode the password with `urllib.parse.quote`.
Node.js (axios)	Pass `proxy: { host, port, auth: { username, password } }` or a proxy agent with credentials in the URL.
Puppeteer	Launch with `--proxy-server=host:port` and call `page.authenticate({ username, password })`.
Playwright	Pass `proxy: { server, username, password }` at launch or per context.
Selenium / Chrome	Chrome ignores credentials in `--proxy-server`: use IP whitelisting, or an extension or a local relay that adds them.

Encode a password with special characters

from urllib.parse import quote
proxy = f"http://USER-cc-us:{quote('p@ss:w/rd', safe='')}@res.hodlproxy.com:9000"

How it works at HodlProxy#

HodlProxy answers 407 with the code invalid_credentials; the dashboard shows the current pair, a rotated password keeps working for ten minutes, and whitelisted addresses need any username to carry parameters.

Questions people ask#

Why do I get 407 with the right username and password?

Usually an invisible character pasted with them, an unencoded special character in a proxy URL, or a client that does not answer the 407 challenge. Test the same credentials with cURL to separate the tool from the account.

Can I avoid 407 entirely?

Yes: whitelist your server's IP address in the dashboard and connect without credentials. Targeting can then be set from the dashboard.

Is a 407 the website blocking me?

No. A 407 comes from the proxy before the request reaches the site. A block by the site shows up as 403, 429, a CAPTCHA or a challenge page.

Proxies

Menu