The starting point
A 407 points to the proxy authentication layer. Start there before changing your destination request or adding retries.
Identify who is asking for credentials
HTTP 407 means the proxy requires authentication. The response includes a Proxy-Authenticate challenge. The client supplies proxy credentials using Proxy-Authorization. Destination authentication is separate: putting your proxy password in the destination's Authorization header is the wrong fix.
For an HTTPS destination, the rejection can happen during CONNECT before your application receives a destination response. Some clients report a proxy or tunnel exception instead of exposing an ordinary Response with status 407.
Check one variable at a time
Use this order to produce a useful reproduction rather than a sequence of unrelated changes.
- Gateway: copy the exact scheme, hostname and port from the account's current setup instructions.
- Method: confirm whether this endpoint expects a username/password, an allowed source IP or another documented authentication mechanism.
- Credential scope: confirm that the username belongs to this product or subuser, not merely the dashboard login.
- Encoding: percent-encode credentials when embedding them in a URL; use separate credential fields when the client supports them.
- Client: check inherited proxy settings and verify that the intended gateway is actually selected.
Compare curl with the failing application
Run the bounded curl recipe in the related guide using the same gateway, destination and credentials. If it works, concentrate on how the application maps those settings. In Playwright, for example, proxy credentials belong in proxy.username and proxy.password rather than httpCredentials.
If both clients fail, remove optional provider-specific country or session modifiers and test the simplest documented credential format. Confirm account access and the endpoint's authentication instructions with the provider. Do not assume that every provider uses 407 for the same billing or product-access condition.
Send a reproducible, sanitized report
Keep the client version, UTC timestamp, gateway host and port, destination hostname, authentication method and status or exception class. State whether the minimal curl reproduction also fails. Those details let support find the attempt without receiving your password.
Remove tokens, credential-bearing URLs, cookies and authorization headers from logs. Stop automatic retries while diagnosing a persistent 407. Once corrected, rerun one request and then the smallest application scenario before restoring normal concurrency.
From reading to doing
Before you ship
- Identify proxy authentication separately from website authentication.
- Reproduce with the same settings in a second client.
- Share sanitized diagnostics instead of credentials or raw traces.
Sources & further reading
Technical references used for this guide. Check the documentation for your installed version and your provider’s supported configuration.