Glossary · Proxies
Proxy authentication
Proxy authentication is how a proxy confirms that a client may use it: under RFC 9110 the proxy answers with status 407 Proxy Authentication Required and a Proxy-Authenticate challenge, and the client sends its credentials in a Proxy-Authorization header.
Reviewed 30 Oct 2026
from urllib.parse import quoteimport requestsuser = quote("USERNAME_pool-arcfast_country-de", safe="")password = quote("PASSWORD", safe="")proxy = f"http://{user}:{password}@proxy.arcproxies.io:8000"r = requests.get("https://example.com/", proxies={"http": proxy, "https": proxy}, timeout=30)print(r.status_code)The 407 exchange
- The client sends a request, or a
CONNECTfor HTTPS, without credentials. - The proxy replies
407and must include at least oneProxy-Authenticatechallenge naming the scheme, usuallyBasic. - The client repeats the request with
Proxy-Authorization: Basic …. Most libraries send it on the first request when the credentials are in the proxy URL. - The header is consumed by the first proxy that asked for it; RFC 9110 scopes it to the next inbound proxy, so the destination site never receives it.
Basic is encoding, not encryption
RFC 7617's Basic scheme joins user-id and password with a colon and encodes the result in Base64, which anyone can decode. The credentials travel in clear wherever the connection to the proxy is unencrypted. HTTPS content inside a CONNECT tunnel is still protected end to end; the proxy password is what is exposed on the path.
Username and password vs IP allowlisting
| Username and password | IP allowlist | |
|---|---|---|
| How access is granted | Credentials on every connection | Requests from listed source addresses |
| Works from changing networks | Yes | Only after updating the list |
| Can carry options | Yes — in the username | No |
ARC's connection strings use username and password. On the rotating gateway the username also carries the pool, country, city and session, as described under backconnect proxy. SOCKS5 uses its own username/password subnegotiation with the same credentials.
Fixing a 407
- Check the credentials against the dashboard; a typo in a username token is the most common cause.
- URL-encode special characters in a password embedded in a proxy URL:
@becomes%40,:becomes%3A. - Make sure the client actually sends credentials for HTTPS. Some tools need them passed separately rather than in the URL — see the Playwright and Python requests guides.
FAQ
Questions
Something not covered? Write to contact@arcproxies.io.
Why do I get 407 even though my password is right?
Usually because of encoding or delivery: a special character in the password breaks the proxy URL, the username is missing a token, or the client is not sending credentials on the CONNECT request. Encode the password and check what the client sends with a verbose flag.
Does the website see my proxy username and password?
No. Proxy-Authorization is meant for the proxy that asked for it and is not forwarded to the destination. Inside an HTTPS tunnel the site only sees what your client sends after TLS is set up.
Is Basic proxy authentication secure?
It protects access, not secrecy: Base64 is trivially reversible, so anyone who can read the connection to the proxy can read the credentials. Keep credentials out of shared logs and rotate them if exposed; the HTTPS content itself stays encrypted.
What is the difference between 401 and 407?
401 Unauthorized means the destination server wants credentials; 407 Proxy Authentication Required means the proxy in between does. They use different header pairs: WWW-Authenticate and Authorization for 401, Proxy-Authenticate and Proxy-Authorization for 407.
Sources & review
Last reviewed by the ARC Proxies team. Prices are read from the live catalog at build time.
- [1]IETF: RFC 9110: HTTP Semantics
- [2]IETF: RFC 7617: The 'Basic' HTTP Authentication Scheme
In practice