407 Proxy Authentication Required: causes and fixes

Most likely first.

1. The username or password is wrong. A typo, a space or line break copied along with the credentials, or an old password after it was changed. Many providers also put options such as country or session in the username, so a misspelled option can look like a wrong username.
2. Special characters in the password were not encoded. Inside a proxy URL such as http://USER:PASS@HOST:PORT, the characters @, :, /, # and % have meaning, so a password containing @ is split in the wrong place. Percent-encode it (@ becomes %40) or pass the credentials in a separate option.
3. The client never sends the credentials. Chrome ignores a username and password written into --proxy-server, and Selenium's proxy setting has no place for them. The proxy then sees a request with no Proxy-Authorization header and answers 407.
4. Your address is not on the IP whitelist. With IP whitelist authentication, the proxy admits only the public addresses you listed. If yours changed, or your connection leaves over IPv6 while the list holds your IPv4 address, the proxy asks for credentials instead.
5. The account cannot carry traffic. Some providers, TrueProxies included, answer 407 when a plan has expired, used its traffic or reached a limit, because the check happens at the same step as the password.

1. 1Read the proxy's answer with curl

   Send one request with verbose output. A < HTTP/1.1 407 line directly after > CONNECT is the proxy refusing. 200 Connection established means the login worked, and any later error comes from the site.

   Show the proxy's answerCopy

   curl -v -x http://HOST:PORT -U "USER:PASS" https://example.com/ -o /dev/null 2>&1 \
     | grep -iE "^(> CONNECT|< HTTP|< x-proxy-reason|\* CONNECT)"

2. 2Rule out encoding

   -U needs no encoding. If -U "USER:PASS" works and the same credentials fail inside -x http://USER:PASS@HOST:PORT, the password needs percent-encoding. This prints the encoded form without putting the password in your shell history:

   Percent-encode a passwordCopy

   read -rs PROXY_PASS
   printf %s "$PROXY_PASS" | python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read(), safe=""))'

3. 3Check the address the proxy sees

   For IP whitelist authentication, compare the list with the addresses these commands print.

   Your public IPv4 and IPv6 addressesCopy

   curl -4 -s https://api.ipify.org; echo
   curl -6 -s https://api64.ipify.org; echo

4. 4Check the account, then test from outside your network

   Look at the provider's dashboard for an expired plan or used-up traffic. Then paste the proxy into the proxy checker, which reports AUTH_REQUIRED when the proxy asks for or rejects authentication.

• Copy the credentials again

  Copy them from the provider's dashboard, trim spaces and line breaks, and stop every client that still sends an old password.

• Encode the password, or keep it out of the URL

  In Python, build the proxy URL with urllib.parse.quote. Use the http:// scheme for the proxy even when the site is HTTPS, unless your provider documents TLS to the proxy on that port.

  Python requestsCopy

  from urllib.parse import quote
  import requests
  
  proxy = f"http://{quote(USER, safe='')}:{quote(PASS, safe='')}@HOST:PORT"
  r = requests.get("https://example.com/", proxies={"http": proxy, "https": proxy}, timeout=30)
  print(r.status_code)

• Read the status in Node.js

  With https-proxy-agent, a refused CONNECT arrives as a response with status 407, not as an error.

  Node.js with https-proxy-agentCopy

  import https from "node:https";
  import { HttpsProxyAgent } from "https-proxy-agent";
  
  const user = encodeURIComponent(process.env.PROXY_USER);
  const pass = encodeURIComponent(process.env.PROXY_PASS);
  const agent = new HttpsProxyAgent(`http://${user}:${pass}@HOST:PORT`);
  
  https.get("https://example.com/", { agent }, (res) => {
    console.log(res.statusCode); // 407 here is the proxy's answer
    res.resume();
  });

• Give browsers credentials the way they accept them

  For Chrome started with --proxy-server and for Selenium, use IP whitelist authentication, or the proxy login options in Playwright and Puppeteer.

• 407 Proxy Authentication Required (RFC 9110, section 15.5.8) — IETF / RFC Editor
• Proxy-Authenticate (RFC 9110, section 11.7.1) — IETF / RFC Editor
• Percent-encoding (RFC 3986, section 2.1) — IETF / RFC Editor
• Username/Password Authentication for SOCKS V5 (RFC 1929) — IETF / RFC Editor