How to Troubleshoot Proxy Authentication and 407 Errors with curl

A 407 Proxy Authentication Required response means the proxy received the request but did not accept usable proxy credentials. It is different from a 401, which comes from the destination server. The fastest fix is to isolate the connection in layers: proxy address, protocol, credentials, authentication method, tunneling, and destination response.

1. Confirm which component returned the error

Run a controlled request with verbose output, but never paste production passwords into shared terminals or tickets.

curl --verbose --proxy "$PROXY_ENDPOINT" \
  --proxy-user "$PROXY_USERNAME:$PROXY_PASSWORD" \
  https://en.98ip.com/

In the trace, identify whether curl reached the proxy, whether the proxy replied with 407, and whether a tunnel was established before the destination responded. Redact Proxy-Authorization, cookies, tokens, usernames, and session parameters before saving logs.

2. Verify endpoint and protocol

Check the hostname, port, and proxy scheme separately. An HTTP proxy, HTTPS proxy, SOCKS5 proxy, and SOCKS5 proxy with remote DNS are not interchangeable. A wrong scheme can look like an authentication failure, TLS error, or immediate connection reset.

Use one explicit configuration during diagnosis. Temporarily remove conflicting HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY variables, or record their values without credentials. Command-line proxy settings normally override environment settings, but hidden environment configuration can still confuse scripts and subprocesses.

3. Test credentials without exposing them

Keep the username and password in protected environment variables or a secret manager. Do not embed them in a committed URL, shell history, screenshot, or process argument visible to other users. If a password contains @, :, %, or other reserved characters, use a client option designed for proxy credentials rather than manually building an unescaped URL.

Confirm that the credential is active, belongs to the correct product, and is permitted to use the selected region, session mode, or source IP. A valid account can still receive 407 when a subaccount is disabled or an IP allowlist does not include the runner.

4. Inspect the advertised authentication method

The proxy can advertise supported methods in its response headers. curl uses Basic proxy authentication by default, but some enterprise proxies require Digest, NTLM, or Negotiate. Use the method required by the proxy rather than repeatedly retrying the same request.

For a managed residential proxy service, a persistent 407 is more often caused by a malformed username, expired password, incorrect zone, or allowlist mismatch than by an enterprise authentication method. Record the exact non-secret account scope before changing client flags.

5. Separate proxy authentication from destination access

After proxy authentication succeeds, the destination can still return 401, 403, 429, or another status. Treat these as a new layer:

• 401: destination authentication is missing or invalid.
• 403: destination policy, permissions, or traffic rules rejected the request.
• 429: request rate or concurrency is too high.
• timeout: routing, DNS, TLS, capacity, or destination latency may be involved.

Do not rotate credentials or IPs blindly. First prove which layer owns the failure.

6. Check tunneling and TLS safely

HTTPS destinations commonly use an HTTP CONNECT tunnel through the proxy. A failure before the tunnel is established points to the proxy connection or authentication layer. A failure after the tunnel begins can involve destination TLS, certificate validation, or application behavior.

Avoid disabling certificate verification as a permanent fix. If an HTTPS proxy uses a private certificate authority, configure the correct proxy CA trust. Keep proxy certificate troubleshooting separate from destination certificate troubleshooting.

7. Use a minimal reproduction

Reduce the test to one target, one proxy endpoint, one credential set, and one request. Remove retries, rotation, concurrency, browser automation, and custom headers. Once the minimal request succeeds, add session parameters, geography, retry logic, and parallelism one at a time.

Capture only safe diagnostics:

• timestamp and runner region;
• curl version and operating system;
• proxy scheme, hostname alias, and port without credentials;
• HTTP status and curl exit code;
• connection, TLS, and total latency;
• redacted response headers;
• credential or subaccount identifier that is not itself secret.

8. Common failure patterns

Works locally but fails in CI

Check missing secrets, protected environment rules, fork restrictions, source-IP allowlists, shell quoting, and newline characters added to stored values.

Works with one password but not a rotated password

Confirm the secret store was updated in the correct environment, restart long-lived runners, and verify that cached containers or scheduled jobs are not using the previous value.

Intermittent 407 responses

Check whether different workers receive different secrets, whether some endpoints use an outdated subaccount, and whether rotation happened before every job adopted the new credential.

Final checklist

• The proxy hostname, port, and scheme are correct.
• Credentials are active and scoped to the selected product and region.
• Special characters are passed safely.
• Source-IP restrictions include the current runner.
• The authentication method matches the proxy requirement.
• Environment variables do not override the intended route.
• Proxy 407 is distinguished from destination 401, 403, and 429.
• Logs and tickets contain no secrets.
• Testing follows applicable law, target terms, and data-handling rules.

For a controlled proxy configuration and support workflow, review the service information on 98IP. Start with a minimal request, protect credentials, and expand only after the authentication layer is stable.

Research basis: curl documentation for proxy authentication and proxy options; MDN HTTP status documentation; Python standard library proxy documentation. Source names are provided as plain text without external links.