---
title: "Proxy authentication"
url: https://proxy.wiki/glossary/proxy-authentication/
type: Glossary Term
author: "proxy.wiki editorial"
published: 2026-08-19
updated: 2026-08-19
site: proxy.wiki
topics: ["Proxy fundamentals"]
license: CC BY 4.0 — quote freely with attribution to https://proxy.wiki/
---

# Proxy authentication

> How a proxy verifies who you are, and the meaning of the 407 status code defined in RFC 9110.

**Proxy authentication is the mechanism by which a proxy confirms you are entitled to use it.** Two approaches dominate: credentials in the request, or [IP whitelisting](/glossary/ip-whitelisting/).

## Credential-based

The client sends a `Proxy-Authorization` header. Most tooling accepts credentials inline:

```
curl -x http://user:pass@gateway.example:8000 https://api.example.com
```

Many providers overload the username field to carry routing parameters — country, [session](/glossary/sticky-session/) identifier, or protocol preference — separated by hyphens or colons. The syntax is provider-specific.

## The 407 status code

A proxy that requires authentication and does not receive valid credentials answers **407 Proxy Authentication Required**, accompanied by a `Proxy-Authenticate` header describing the scheme.

The distinction that costs people time: **407 comes from the proxy, 401 comes from the destination.** A 407 means your proxy credentials are wrong. A 401 means you reached the target and its own authentication rejected you. Treating them as the same error sends you debugging the wrong system.

## Reference

407 is specified in [RFC 9110, section 15.5.8](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.8). The wider framework is described in [RFC 7235](https://www.rfc-editor.org/rfc/rfc7235.html).

## Sources

1. [RFC 9110 §15.5.8: 407 Proxy Authentication Required](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.8)
2. [RFC 7235: HTTP Authentication](https://www.rfc-editor.org/rfc/rfc7235.html)