Python Guide · 1 min read

How to use proxies with Python Requests

Configure Requests proxy routing, remote DNS and TLS separately. Check the issued endpoint, handle failures without exposing credentials, and verify the exit actually used.

The proxies dict and why the scheme matters

Python's requests library talks to a proxy through a single dictionary. The keys are not the proxy's protocol — they are the scheme of the target URL. So {"http": ..., "https": ...} tells requests which proxy to use when the destination is an HTTP or HTTPS site, and in practice both keys point at the same endpoint.

The scheme inside the proxy URL selects proxy behaviour. socks5:// resolves target names locally; socks5h:// asks the proxy to resolve them. Remote DNS does not encrypt the SOCKS connection: the proxy receives the hostname, and username/password authentication can be sent in cleartext. HTTPS with certificate verification protects application content, not the SOCKS negotiation. Use an encrypted tunnel if the client-to-proxy path also needs protection. For an authenticated s4m.online proxy, use the issued endpoint and check the exit IP for routed requests.

Proxy schemeDNS resolved byPortInstall
socks5h://Proxy (remote)1080requests[socks]
socks5://Your machine (local)1080requests[socks]
http://Proxy3128Stock requests

SOCKS support needs PySocks (pip install "requests[socks]"); the HTTP endpoint works with a stock install. s4m proxies are datacenter SOCKS5 and HTTP, billed per gigabyte — see pricing. If you only need throwaway endpoints for quick tests, the free public proxy list is a separate, third-party pool (use at your own risk). Choosing between a full tunnel and a proxy? Read the comparison, the VPN overview, or more guides.

Requests · RFC 1929

Full runnable example

Use the host and credentials issued to your account. This example prompts for secrets, verifies TLS, and tries configured transports in order. Switching SOCKS5 to HTTP on the same host does not promise another exit IP.

python
import getpass
from urllib.parse import quote

import requests
from requests.exceptions import ConnectionError, ProxyError, SSLError, Timeout


def endpoints(host, username, password):
    auth = f"{quote(username, safe='')}:{quote(password, safe='')}"
    return [
        f"socks5h://{auth}@{host}:1080",  # requires requests[socks]
        f"http://{auth}@{host}:3128",    # HTTP proxy; HTTPS uses CONNECT
    ]


def proxies_for(proxy_url):
    return {"http": proxy_url, "https": proxy_url}

def fetch_with_fallback(session, url, proxy_urls, ca_bundle=True):
    # Ignore environment proxy/bypass overrides. Configure custom CA bundles
    # with ca_bundle="/path/to/ca.pem" if needed; verification stays enabled.
    if ca_bundle is not True and (not isinstance(ca_bundle, str) or not ca_bundle):
        raise ValueError("Use True or an explicit CA bundle path")
    session.trust_env = False
    for proxy_url in proxy_urls:
        try:
            response = session.get(
                url,
                proxies=proxies_for(proxy_url),
                timeout=(5, 15),
                verify=ca_bundle,
            )
            response.raise_for_status()
            return response
        except SSLError:
            raise RuntimeError("TLS verification failed; not retried") from None
        except (ProxyError, ConnectionError, Timeout):
            # Never print the authenticated URL or the transport exception.
            continue
    raise RuntimeError("All configured proxy transports failed") from None


if __name__ == "__main__":
    host = input("Proxy host from your account (without scheme or port): ").strip()
    username = input("Proxy username: ")
    password = getpass.getpass("Proxy password: ")
    SOCKS5, HTTP = endpoints(host, username, password)
    with requests.Session() as session:
        try:
            response = fetch_with_fallback(
                session,
                "https://api.ipify.org?format=json",
                [SOCKS5, HTTP],
            )
            print("Exit IP:", response.json()["ip"])
        except (requests.RequestException, RuntimeError):
            raise SystemExit("Request failed; check the endpoint, credentials and TLS settings") from None

Per-request, per-session, or global

Per-request

Pass proxies= to each call: requests.get(url, proxies=proxies_for(SOCKS5), timeout=10). The most explicit form, and the easiest to swap or rotate on a call-by-call basis.

Per-session

A Session reuses connections and cookies, but environment proxies can override session.proxies. Pass proxies= on each request for explicit selection. trust_env=False also ignores environment CA and authentication settings; configure required CA bundles explicitly.

Global via environment

Requests reads HTTP_PROXY, HTTPS_PROXY and ALL_PROXY when environment settings are trusted. Scheme-specific proxies and NO_PROXY affect routing. Check existing settings and the actual request; one ALL_PROXY value is not a guarantee that every request uses it.

Things that trip people up

Auth goes in the URL

URL-encode the username and password separately with urllib.parse.quote(value, safe=""). Keep credentials out of logs and shared source files. The example asks for a password without echoing it.

Keep DNS remote

socks5 resolves the target name locally; socks5h asks the proxy to resolve it. This controls DNS placement, not encryption or all other application traffic. Check the routed request and keep TLS verification enabled.

Reuse a Session

A requests.Session pools connections and persists cookies, so a burst of requests through one proxy is noticeably faster than calling requests.get() cold each time.

Leave TLS verification on

A proxy only forwards your traffic — it is no reason to set verify=False. Keep certificate verification enabled so an intermediary cannot silently tamper with HTTPS responses.

FAQ

Questions, answered

Do SOCKS5 proxies need an extra package?

Yes. requests needs PySocks for SOCKS support: install it with pip install "requests[socks]". The HTTP endpoint on port 3128 works with a stock requests install and no extra dependency.

What is the difference between socks5 and socks5h?

socks5:// resolves the target name locally; socks5h:// sends the hostname to the proxy for resolution. Neither scheme alone encrypts SOCKS authentication. HTTPS with certificate verification protects application content.

Why isn't my exit IP changing when I rotate?

A different proxy URL or a new Session does not necessarily select a different exit. SOCKS5 and HTTP on the same host may share one address. Use the endpoint issued for the desired exit and verify it with an IP-echo request; cookies and other identifiers remain separate.

Are these residential IPs?

No. s4m proxies are datacenter SOCKS5 and HTTP endpoints, authenticated with a username and password and metered per gigabyte. The separate free public proxy list is third-party and unvalidated for production use.

How do I skip a dead proxy in a list?

Try only the configured endpoints, with bounded connect/read timeouts. The example advances on connection or timeout failures without printing authenticated URLs. TLS and HTTP status failures are not treated as reasons to bypass verification or retry access through another address.

Proxies built to hide your origin IP

Configure s4m SOCKS5 or HTTP access with the credentials from your account.

People found this page by searching for

Real search phrases this page answers — the linked ones open the page that covers them in depth.