407 Proxy Authentication Required
A proxy between the client and the server needs credentials. This is 401 raised by the intermediary rather than by the origin.
At a glance
- Status code
- 407 Proxy Authentication Required
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 9110
- Cacheable by default
- no
- Response body
- Optional, plus a mandatory Proxy-Authenticate header.
In detail
The request never reached the origin server. The proxy stopped it and is asking to be authenticated itself, using Proxy-Authorization rather than Authorization.
Only a proxy should send it. An origin server returning 407 is telling the client to authenticate against a proxy that does not exist from the client's point of view.
In a corporate network, this usually means the outbound proxy needs credentials that the tool was never given. Command line tools need them set explicitly, they do not inherit browser settings.
Examples
HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="corp"Things that catch people out
- Proxy credentials go in Proxy-Authorization. Putting them in Authorization sends them to the origin server instead, which is both useless and a credential leak.
- A 407 on a CONNECT request breaks TLS tunnelling before the handshake, so the error can surface as an unrelated certificate failure.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →401 Unauthorized
The request lacks valid credentials. Despite the name, this is about authentication (who you are), not authorisation (what you may do).
502 Bad Gateway
A proxy or load balancer got an invalid response from the upstream server it was relaying to. The failure is behind the thing that answered you.
305 Use Proxy
Deprecated. It once told the client to repeat the request through the proxy named in Location, which turned out to be a security problem.
408 Request Timeout
The server gave up waiting for the client to finish sending the request and closed the idle connection.
409 Conflict
The request clashes with the current state of the resource, for example an edit based on a version that has since changed.
410 Gone
The resource existed and has been permanently removed with no forwarding address. Stronger and more useful than 404 when you know the removal is final.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL