< HTTP/1.1 407 Proxy Authentication Required

TL;DR: 407 comes from a proxy, not the website. It wants credentials in a Proxy-Authorization header before it will forward your request. Check which scheme Proxy-Authenticate asks for, then supply credentials the tool actually supports (Basic is common; NTLM/Kerberos usually need a helper).

What it means

This is the proxy equivalent of 401. The proxy challenges you, you retry with credentials, the proxy forwards the request. RFC 9110 §15.5.8 requires the 407 to include Proxy-Authenticate.

GET http://example.com/ HTTP/1.1
Host: example.com

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="Corp Proxy"
Content-Type: text/html
Content-Length: 0

Retry with credentials:

GET http://example.com/ HTTP/1.1
Host: example.com
Proxy-Authorization: Basic YWxpY2U6czNjcmV0

The value is base64("alice:s3cret"). Basic is not encryption. Over plain HTTP it is readable by anything on the path to the proxy, so only use it to a proxy you reach over a trusted network or TLS.

HTTPS goes through CONNECT

For https:// URLs, a client asks the proxy to open a tunnel with CONNECT, and the proxy usually challenges there:

CONNECT api.example.com:443 HTTP/1.1
Host: api.example.com:443

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Negotiate
Proxy-Authenticate: NTLM
Proxy-Authenticate: Basic realm="Corp Proxy"

This is why the symptoms look TLS-shaped even though it is an HTTP-level refusal. You will see:

curl: (56) Received HTTP code 407 from proxy after CONNECT

pip: ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 407 Proxy Authentication Required'))

Chrome shows ERR_TUNNEL_CONNECTION_FAILED when it cannot authenticate to the proxy, or prompts for credentials if it can.

Diagnosis

1. Find out which proxy is in play: env | grep -i proxy, git config --get http.proxy, npm config get proxy, system settings, or a PAC file.
2. See what the proxy offers:

curl -v -x http://proxy.corp.example:8080 https://example.com/ 2>&1 | grep -i -E 'proxy-authenticate|HTTP/1.1 407'

3. Read the schemes. Basic works with username and password in most tools. NTLM and Negotiate (Kerberos) tie to your Windows login, and most CLI tools cannot do them natively.

Fix it per tool

curl:

curl -x http://proxy.corp.example:8080 --proxy-user alice:s3cret https://example.com/

# NTLM / Negotiate
curl -x http://proxy.corp.example:8080 --proxy-ntlm --proxy-user alice:s3cret https://example.com/
curl -x http://proxy.corp.example:8080 --proxy-negotiate --proxy-user : https://example.com/

Environment variables (honoured by curl, pip, Go, Python requests and many others). Percent-encode special characters in the password:

export HTTPS_PROXY='http://alice:p%40ss%23word@proxy.corp.example:8080'
export HTTP_PROXY="$HTTPS_PROXY"
export NO_PROXY='localhost,127.0.0.1,.corp.example'

npm, pip and git:

npm config set proxy http://alice:s3cret@proxy.corp.example:8080
npm config set https-proxy http://alice:s3cret@proxy.corp.example:8080

pip install --proxy http://alice:s3cret@proxy.corp.example:8080 requests

git config --global http.proxy http://alice:s3cret@proxy.corp.example:8080

Credentials in config files and shell history are a leak risk. Prefer environment variables from a secrets store or an interactive prompt (curl --proxy-user alice prompts for the password).

If the proxy only offers NTLM or Kerberos, run a local forwarding helper (cntlm, px, or a corporate-provided agent), point your tools at http://127.0.0.1:3128, and let the helper authenticate upstream.

If you operate the proxy

Squid with Basic authentication:

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm Corp Proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

Two operational traps. First, Proxy-Authorization is a hop-by-hop credential: the proxy must not forward it to the origin. Second, if your proxy does a 407 challenge on a plain HTTP request and your client is an API SDK that does not understand proxy auth, the SDK often surfaces an unhelpful JSON parse error because the 407 body is an HTML page.

407 vs 401 vs 403

	401	407	403
Issued by	Origin	Proxy	Either
Challenge header	WWW-Authenticate	Proxy-Authenticate	none
Retry with	Authorization	Proxy-Authorization	credentials will not help

Related

• 401 Unauthorized: the origin-server version.
• 403 Forbidden
• Proxy-Authenticate and Proxy-Authorization
• Via: shows proxies a request passed through.
• 502 Bad Gateway: what a proxy returns when it can reach no upstream.