Skip to contentHTTP 407 Proxy Authentication Required: how to fix it
A 407 is the proxy — not the website — telling you it needs credentials it did not get. This guide explains exactly what triggers it and walks through the fixes for curl, browsers, Python, Windows and corporate proxies.
What a 407 actually means
HTTP 407 Proxy Authentication Required comes from the proxy, not the destination site. It is the proxy's way of saying "I will forward your request, but first prove who you are." It is the proxy-layer twin of a 401: the response carries a Proxy-Authenticate header describing the scheme it wants (usually Basic), and your client is expected to resend the request with a Proxy-Authorization header. If the credentials are missing, malformed, or wrong, you get a 407.
With authenticated proxies like s4m's — SOCKS5 on 1080, HTTP on 3128, both using USER:PASS — a 407 almost always means one of four things: you supplied no credentials, you supplied the wrong ones, the password contains special characters that broke URL parsing, or the tool you are using does not read credentials from where you put them (a classic with Puppeteer and Scrapy). The fixes below are ordered from most to least common. See the proxy authentication guide and the proxy overview for background.
Supply credentials correctly, per tool
The same USER:PASS, in the place each tool actually reads it. Replace with your credentials.
# curl: inline in URL, or with -U (URL-encode special chars, e.g. @ -> %40) curl -x http://USER:[email protected]:3128 https://api.ipify.org curl -x proxy.s4m.online:3128 -U USER:PASS https://api.ipify.org # wget: dedicated flags wget -e https_proxy=proxy.s4m.online:3128 \ --proxy-user=USER --proxy-password=PASS https://example.com # Python requests: credentials belong in the proxy URL # proxies = {"http": "http://USER:[email protected]:3128", # "https": "http://USER:[email protected]:3128"} # requests.get(url, proxies=proxies) # Environment variables (many tools read these): export HTTPS_PROXY="http://USER:[email protected]:3128" # Special characters? URL-encode the password: # pa@ss -> pa%40ss (Python: urllib.parse.quote(pw, safe='')) # Verify it worked: a 200 with an IP body means auth passed. curl -o /dev/null -s -w "%{http_code}\n" \ -x http://USER:[email protected]:3128 https://api.ipify.org
Fix a 407, step by step
Work down this list; most 407s are resolved by step 3.
Confirm the proxy needs auth
s4m proxies require USER:PASS. A 407 means the proxy got no valid credentials — so the question is only where yours are going astray, not whether auth is needed.
Check the credentials are exactly right
Re-copy USER and PASS from your dashboard. A trailing space, a wrong character, or an expired credential all produce a 407. Test them in a single curl -x command first.
URL-encode special characters
If the password contains @, :, /, # or similar, encode them (@ becomes %40). Unencoded, they break the proxy URL so the client sends wrong or partial credentials.
Put credentials where the tool reads them
Some tools ignore URL credentials: Puppeteer needs page.authenticate(), Scrapy needs a Proxy-Authorization header. Match the method to the tool, not just the proxy.
Browsers, Windows and corporate proxies
In a browser, a 407 usually surfaces as a login popup from the proxy; entering the right username and password clears it. When automating a browser, that popup is the whole problem — headless Chromium cannot answer it, which is why Puppeteer uses page.authenticate(), Playwright takes credentials in its proxy object, and Selenium needs a small extension. On Windows, check the system proxy under Settings and any per-app proxy, since a stale saved credential there can trigger 407s in tools that inherit the system proxy.
Corporate proxies add a wrinkle: some use NTLM or Kerberos instead of Basic auth, so a plain USER:PASS is not enough and you need the tool's NTLM option. s4m itself uses standard Basic USER:PASS, so you will not need NTLM with our endpoints. If credentials are definitely correct and you still see 407, confirm you are hitting the right port (1080 SOCKS5, 3128 HTTP) and validate the endpoint with the tools. A related Chrome error is covered in the ERR_PROXY_CONNECTION_FAILED guide.
Questions, answered
Is a 407 error the website's fault or the proxy's?
The proxy's. HTTP 407 Proxy Authentication Required is returned by the proxy, not the destination site, telling you it needs valid credentials before it will forward your request. The website is never reached until you authenticate.
Why do I get 407 even with the right password?
Most often the password contains special characters that break the proxy URL, so the client sends the wrong value. URL-encode them (for example @ becomes %40). Also confirm the tool reads credentials from where you put them.
How do I fix 407 in Puppeteer, Playwright or Selenium?
Browsers ignore credentials in the proxy flag. Use page.authenticate() in Puppeteer, the username/password fields of the proxy object in Playwright, and a small credential extension in Selenium.
Does s4m use NTLM proxy authentication?
No. s4m uses standard Basic USER:PASS authentication on ports 1080 (SOCKS5) and 3128 (HTTP). NTLM only applies to some corporate proxies, not to our endpoints.
Proxies with straightforward auth
s4m proxies use plain USER:PASS on proxy.s4m.online — no NTLM, no surprises. Metered datacenter SOCKS5 and HTTP, with a dedicated IP option for allowlisted access.
People found this page by searching for
- HTTP 407 proxy authentication required
- how to bypass website blocks
- fresh free proxy list
- how to bypass Geo-Blocking with a VPN or proxy
- best proxy setup 2026
- proxy for scraping
- wireguard tutorial
- http proxy
- buy http proxy
- WhatsApp proxy
- socks5 proxy settings
- proxy authentication
Real search phrases this page answers — the linked ones open the page that covers them in depth.