“The proxy requires a username and password” means the proxy is asking you to authenticate before it forwards your request. Enter the provider-generated proxy credentials, then check that your app supports the chosen proxy protocol and authentication method if the prompt returns.
What does 407 Proxy Authentication Required mean?
407 is an HTTP authentication challenge from a proxy. RFC 9110 specifies a Proxy-Authenticate response header; the client can answer with Proxy-Authorization. A first challenge can be normal. Repeated challenges after supplying credentials need investigation.
Proxy credentials authorize gateway access, separately from the destination website's login. A 407 alone does not tell you that the website blocked your proxy.
Fixes for “the proxy requires a username and password”
Step 1
Copy the complete proxy configuration
Get the host, port, protocol, proxy username and proxy password from the provider's setup page. Keep any generated location or session parameters in the username. Put each value in its matching field; a host field should not contain the whole proxy string.
Step 2
Separate proxy access from account access
Use the credentials generated for proxy connections. An activation code redeems access; it is not the password to enter in a browser's proxy prompt. For example, the NovProxy setup guide explains redemption and endpoint generation separately for NovProxy GB codes, listed under residential GB plans.
Step 3
Handle special characters in the right place
In a dedicated password field, enter the password literally. Inside a proxy URL, encode reserved characters in the credential components: @ becomes %40. The curl manual documents URL decoding of embedded proxy credentials. Encoding an entire URL would also change its separators.
Browser and device proxy authentication settings
Chrome proxy login popup, Edge and Windows settings
Step 4
Correct the Windows endpoint
On Windows, open Settings → Network & internet → Proxy. Under Manual proxy setup, configure Use a proxy server with the provider's host and port, then save. See Microsoft's Windows proxy setup instructions.
Step 5
Answer the browser's authentication request
Open a page and supply the proxy username and password when challenged. Chrome ignores credentials embedded in manual proxy settings, according to Chromium's proxy documentation. Microsoft documents the same limitation for Edge. Pasting username:password@host into an address setting does not solve it.
Step 6
Check protocol support or extension credentials
Chrome and Edge do not support SOCKS5 authentication. Use the provider's HTTP endpoint for browser username/password access, if available. Change the port to match that endpoint too. For an HTTP proxy extension, check its separate credential fields; Chrome's extension API supports answering authentication challenges. Setting a host and port alone does not supply a password.
Firefox
Step 7
Open Firefox's proxy controls
Search Firefox Settings for proxy and open the connection settings. Mozilla's connection settings guide covers both Use system proxy settings and Manual proxy configuration. Choose the one you intend to use.
Step 8
Match the HTTP endpoint and HTTPS setting
For manual HTTP configuration, enter the hostname and port. Select Also use this proxy for HTTPS when the same endpoint should handle HTTPS destinations. Supply proxy credentials when asked. The dialog also identifies extensions controlling the connection; check these if the endpoint differs from your entry.
Android
Step 9
Check the Wi-Fi proxy and the affected app
Open the Wi-Fi network's advanced proxy options and check the host and port. Samsung's connection guide places proxy settings among advanced Wi-Fi options. Android's ProxyInfo reference describes endpoint configuration using host and port; entering those values does not itself supply authentication credentials. Apps using other HTTP stacks must retrieve and apply the proxy configuration themselves, so check that the affected app honors the Wi-Fi proxy. If the affected app has no way to provide them, use its documented authenticated-proxy configuration or a provider-supported IP whitelist.
Check the credentials with curl
Step 10
Make one request through the same endpoint
Use this command template with your provider's HTTP host, port and credentials. All uppercase values are placeholders. On Windows PowerShell use curl.exe; on other shells use curl.
curl.exe --proxy "http://PROXY_HOST:PORT" --proxy-user "PROXY_USERNAME:PROXY_PASSWORD" --proxy-anyauth --include "https://example.com/"
The curl authentication guide documents --proxy-user and --proxy-anyauth. The latter negotiates a supported HTTP proxy authentication method. With --proxy-user, a password containing @ stays outside the proxy URL. The curl manual recommends loading secrets from a file or similar source rather than placing them in command-line arguments. Keep real passwords out of saved command history and shared output; shell escaping is separate from URL encoding.
Step 11
Read the final result
A challenge during negotiation can precede success. If the request ultimately fails with 407, recheck the credentials and provider access settings. If it succeeds while the browser fails, compare the browser's endpoint, protocol and authentication configuration. For a timeout, check endpoint reachability.
Python Requests proxy authentication
Step 12
Put credentials in the proxy configuration
For Python Requests, supply a proxies dictionary to the request, with the appropriate http and https destination keys. Requests documents HTTP Basic proxy authentication using http://user:password@host:port; proxy formats explained shows how to build that URL from host:port:user:pass. Its ordinary auth argument is for destination authentication. Encode the username and password components with urllib.parse.quote, using safe="", before building the proxy URL. Explicit per-request proxy settings also avoid environmental proxies overriding session-level settings.
IP whitelisting instead of proxy credentials
Whitelisting authorizes the public source IP connecting to the proxy. Thordata states that its whitelist method allows requests without per-request credentials.
| Method | What authorizes access | What to check |
|---|---|---|
| Username and password | Proxy credentials sent by the client | Correct credentials and app support |
| IP whitelist | Approved public source IP | Current network address and provider whitelist mode |
Step 13
Authorize the connecting network
Add your current public source IP to the provider's whitelist and generate an endpoint in whitelist mode. Use the connecting network's address, rather than the proxy exit address or a private LAN address. Update the whitelist when that source address changes, such as after switching networks.
Proxy authentication troubleshooting
| Symptom | Check | Next action |
|---|---|---|
| Proxy keeps asking for password | Username, password and generated parameters | Copy the full credentials again |
| Password contains @ | Dedicated field versus URL | Use literal text in fields; encode URL components |
| curl works, browser fails | Endpoint, protocol, authentication support | Match the working configuration |
| Whitelist stopped working | Public source IP and selected mode | Update the authorized source address |
| Access stopped yesterday | Credentials, account access and remaining traffic | Check the provider dashboard and its error guidance |
FAQ
Why does Chrome keep asking for the proxy password?
The proxy is issuing another authentication challenge. Check the generated credentials, then confirm Chrome is using the intended HTTP endpoint. Credentials embedded in manual proxy settings are ignored.
Can I save credentials when the proxy requires a username and password?
Chrome ignores credentials embedded in its manual proxy settings. Enter credentials at the browser prompt or in the separate fields of an HTTP proxy extension that supports authentication challenges.
Can Chrome or Edge authenticate to a SOCKS5 proxy?
Neither browser supports SOCKS5 authentication. For username/password access, choose the provider's HTTP endpoint and matching port if available, or use a client that supports the provider's authentication method.
Why do I get 407 after it worked yesterday?
Something in authentication or access may have changed. Check for changed credentials, a changed source IP in whitelist mode, and the provider account's access and traffic status. A 407 by itself does not identify which changed.
Is a 407 the same as a website login error?
No. A 407 requests proxy authentication. HTTP 401 requests authentication to the destination server; entering the website's password into the proxy prompt addresses the wrong connection.