407 Proxy Authentication Required: fix the proxy login

Proxy error · Last revised Oct 20, 2026

Confirm that the proxy sent it

Run one request with curl and print the proxy’s answer and the site’s answer side by side (the %{http_connect} variable is “the numerical code that was found in the last response (from a proxy) to a curl CONNECT request”, curl man page):

curl -s -o /dev/null -x "http://USERNAME:[email protected]:8000" \
  -w "proxy %{http_connect} site %{http_code}\n" https://api.ipify.org

With a wrong password, our test proxy answered (run on Oct 19, 2026):

proxy 407 site 000

“site 000” means no request reached the site at all. Without -o /dev/null, curl prints curl: (56) CONNECT tunnel failed, response 407. Python Requests raises ProxyError with Tunnel connection failed: 407 Proxy Authentication Required, and wget prints Proxy tunneling failed: Proxy Authentication Required.

Fix it, most likely cause first

1. The username or password is wrong or mistyped. Copy both again from the provider’s dashboard. Many providers issue a separate proxy login that is not your account’s email and password.
2. The password belongs to another sub-user or zone. Where a provider issues one login per sub-user or per zone, the password must be the one of the sub-user or zone your username names. At Bright Data “every zone has a name and one or more password”, and the zone’s name is part of the username (Bright Data); Oxylabs logs you in as a proxy user you create in its dashboard: “Use the same credentials you typed in while creating a new proxy user in the Oxylabs dashboard” (Oxylabs). A password copied from another zone, another sub-user or the account itself gets a 407.
3. A character in the password breaks the address. In http://user:pass@host:port, an @, : or # inside the password ends it early. Encode it (@ is %40, : is %3A), or pass the login separately: curl’s -U "USERNAME:PASSWORD", wget’s --proxy-user and --proxy-password.
4. The username carries settings the provider does not accept. Many residential providers read country, city or session choices from extra parts of the username. A part the provider cannot read (a misspelled country code, a city the plan does not cover) may be refused with a 407 or another error. Remove every extra part, test, then add them back one at a time.
5. Your plan allows only listed IP addresses. With IP allowlisting (whitelisting), the proxy accepts only connections from addresses you have added in its dashboard. Your office, a new server or a home connection whose address changed gets a 407 until you add it. How the two login methods differ: username and password vs IP whitelist.
6. The plan has run out. Some providers refuse the login once the traffic is used up, rather than showing a page that says so. Rayobyte’s own help page says of its 407: “One of the most common causes is an empty Residential bandwidth balance” (Rayobyte). Check the balance in the dashboard before you change anything else.
7. Your tool never sends the login. A browser asks for it in a pop-up, and headless browsers need it set in code. If a command works in curl but not in your tool, the tool is the cause.

What not to do

Do not retry in a loop. A 407 is the same answer every time until the login changes, and a provider that sees many failed logins from one address may block it. Do not rotate to another country or session to “get past” it: those settings travel in the same login, so they cannot help.

When the login works

Once curl prints proxy 200, the proxy is working, and any error after that comes from the site: start with 403 Forbidden or 429 Too Many Requests. To check the whole connection step by step, see how to test a proxy.