HTTP 407 Proxy Authentication Required explained

The symptom

A browser, API, or server request returns 407 Proxy Authentication Required. Traffic is being forced through a proxy, and the proxy will not forward the request until the client provides the correct proxy credentials. The status is surfaced by the proxy, not by the destination site, so the site itself may be perfectly healthy.

What 407 means

407 Proxy Authentication Required is the proxy equivalent of 401 Unauthorized: it tells the client that a proxy in the path requires authentication before it will pass the request on. It is issued by the proxy with a Proxy-Authenticate header describing the challenge, and the client answers on the Proxy-Authorization header. It is distinct from 401, which comes from the origin server itself and uses WWW-Authenticate / Authorization.

Common causes

• The operating system or network is configured to route HTTP through a corporate or school proxy that demands a login.
• A captive portal (airport, hotel, public WiFi) intercepts requests with a proxy-style prompt before issuing an internet connection.
• A command-line tool or script has no proxy credentials set, or uses the wrong proxy scheme, so the proxy refuses its traffic.
• The browser proxy settings point at a proxy that is down, so every request spins before a 407 or connection failure.

Fix the client

1. Supply the proxy credentials the network expects. In a script with curl, set the username and password explicitly:

curl -x http://proxy.example.com:8080 \
  -U "user:password" https://example.com/

1. When a captive portal is involved, open a browser and complete the network sign-in page (terms or login), then retry. The 407 clears once the portal session exists.
2. If a VPN provides the expected proxy, connect it; the request then routes correctly.
3. In a corporate environment, use the proxy configuration the organisation provides (a PAC file or system proxy) instead of guessing a proxy address.

Fix server and proxy configuration

When you run the proxy and clients fail with 407:

• Confirm the Proxy-Authenticate challenge advertises the right scheme (for example Basic or NTLM) and that clients reply on Proxy-Authorization, not Authorization.
• Check that the proxy domain/service the clients assume is the one actually listening on the port, since a mismatch drops credentials and reissues 407.
• Verify the proxy allows the requested site; some proxies return 407 or block when the destination is not on an allowlist.

Distinguish from other statuses

Compare 407 with 401 (origin wants credentials, per the 401 guide) and with 511 Network Authentication Required (which asks a browser to sign in to a network to gain access, per the 511 guide). If a connection also resets after the proxy step, see ERR_CONNECTION_RESET. Get the proxy credentials and the authentication scheme aligned, and 407 disappears from your logs.