Crypto
09 Jan 2026
Read 14 min
How to fix HTTP 407 proxy authentication error fast *
how to fix HTTP 407 proxy authentication error and restore downloads quickly now with simple fixes
Fix the issue fast by confirming your proxy username and password, checking the proxy address and port, turning on the correct system or browser proxy setting, and testing with curl. Clear cached credentials if they’re wrong. If you’re on a corporate network, sign in to VPN, sync your time, and ask IT to allowlist your destination. That’s how to fix HTTP 407 proxy authentication error quickly.
A 407 error means your proxy wants credentials before it will pass your request to the internet. Browsers, CLI tools, and apps all hit this when the proxy settings or login are wrong, expired, or missing. Use the steps below to locate the cause, fix it, and prevent it from coming back.
401 vs 407: 401 means the destination server wants auth. 407 means the proxy in the middle wants auth.
403 vs 407: 403 is forbidden after the destination server understood you. 407 is blocked at the proxy layer before reaching the site.
Confirm proxy address and port. A single wrong digit causes 407.
Verify username and password with your network admin or portal.
If you use SSO, connect to VPN and sign in to your company’s auth portal.
Clear old credentials in your browser, OS keychain, or CLI tool.
Test with curl using your proxy and credentials to isolate the problem.
Check if your password expired or your account was disabled.
Disable proxy temporarily to verify the site works without it.
Make sure your system time is correct. Kerberos and NTLM need accurate time.
Ask IT to allowlist the site if policy blocks it.
Open Settings > Network & internet > Proxy. Turn on “Use a proxy server” and enter the address and port exactly as given by IT.
If your company uses automatic configuration, enable “Use setup script” (PAC) and paste the script URL.
Open Credential Manager and remove any saved proxy credentials that are wrong. Sign out and sign back in.
If the proxy uses Windows Integrated Authentication (NTLM/Kerberos), make sure you are logged in with your domain account and the clock is in sync with the domain.
Go to System Settings > Network > your network > Details > Proxies.
Enable Web Proxy (HTTP) and Secure Web Proxy (HTTPS). Enter your proxy host and port. Check “Proxy server requires password” if needed, then enter your credentials.
If you use Automatic Proxy Configuration (PAC), enable it and paste the URL. Click OK and Apply.
Open Keychain Access, search for “Proxy,” and delete stale entries if your password changed. Reconnect and re-enter credentials.
Set environment variables for your shell if your tool uses them:
http_proxy=http://user:pass@proxy.company.com:port
https_proxy=http://user:pass@proxy.company.com:port
no_proxy=localhost,127.0.0.1,.company.com
Export them in your shell profile if needed.
If your network uses a PAC file, configure the desktop environment proxy settings or use a helper like proxychains when permitted by policy.
Keep system time accurate (use systemd-timesyncd or NTP).
Chrome/Edge: They use system proxy settings. Fix them at the OS level. Clear cached logins: chrome://settings/passwords, and clear site data if the proxy auth window loops.
Firefox: Settings > Network Settings > Settings. Choose “Auto-detect,” “Use system proxy,” or “Manual proxy.” Enter host, port, and credentials. For NTLM/Kerberos, set network.negotiate-auth.trusted-uris to your domain.
Quick test:
curl -I –proxy http://proxy.company.com:port https://example.com
With credentials:
curl -I –proxy-user user:pass –proxy http://proxy.company.com:port https://example.com
For NTLM:
curl -I –proxy-ntlm –proxy-user DOMAINuser:pass –proxy http://proxy:port https://example.com
Set proxy:
git config –global http.proxy http://user:pass@proxy.company.com:port
git config –global https.proxy http://user:pass@proxy.company.com:port
If your credentials change, update .gitconfig and clear old entries from your credential helper:
git credential reject (then enter the proxy URL when prompted)
For NTLM, use a wrapper like CNTLM when allowed by policy, and point Git to that local proxy.
Set npm proxies:
npm config set proxy http://user:pass@proxy.company.com:port
npm config set https-proxy http://user:pass@proxy.company.com:port
For global environment:
set HTTP_PROXY / export HTTP_PROXY, and set HTTPS_PROXY similarly.
If SSO is required, use a system helper (like CNTLM) or your company’s SSO proxy. Avoid storing plain passwords in .npmrc; prefer a credential manager when available.
Temporary:
pip install package –proxy http://user:pass@proxy.company.com:port
Persistent:
Create or edit pip.ini (Windows) or pip.conf (Linux/macOS) with a proxy URL, or set environment variables HTTP_PROXY and HTTPS_PROXY.
If using requests, pass proxies={‘http’: ‘http://…’, ‘https’: ‘http://…’} and, if needed, auth. For NTLM, use requests-ntlm per company policy.
Build-time: Create ~/.docker/config.json with “proxies”: {“default”: {“httpProxy”: “http://user:pass@proxy:port”, “httpsProxy”: “http://user:pass@proxy:port”, “noProxy”: “localhost,127.0.0.1,.company.com”}}.
Runtime: Export HTTP_PROXY and HTTPS_PROXY before docker build or docker run.
If the proxy uses self-signed certs, add your company root CA to Docker’s trust store.
Maven/Gradle: Set proxy in settings.xml (Maven) or gradle.properties. Use environment variables for CI.
VS Code/JetBrains: Configure HTTP proxy in settings, and enable Use system proxy. For corporate NTLM, enable built-in authentication support.
Check the error headers. Use curl -v or your browser dev tools. Look for Proxy-Authenticate: NTLM, Kerberos, Basic. Match your client to one of these.
Confirm reachability. Can you ping or telnet proxy.company.com on the given port? If not, the proxy is down, blocked, or the address is wrong.
Test credentials. Try signing into the company portal or a known site through the proxy. If it fails, your credentials or account may be the issue.
Review PAC logic. If you use a PAC file, open it in a text editor. Check if the site should go direct or through the proxy. Wrong PAC rules cause 407 loops.
Check group policies or MDM profiles that may override your manual settings.
Use a credential manager (Windows Credential Manager, macOS Keychain, GNOME Keyring) instead of hardcoding passwords.
Prefer Integrated Authentication (Kerberos/NTLM) if your company supports it. It avoids storing passwords and reduces prompts.
If you must store passwords in config files, restrict file permissions and avoid committing them to Git.
Use HTTPS to the proxy if supported to protect credentials in transit.
Document proxy settings per team and keep them in onboarding docs.
Use environment templates (.env.example) for developers and CI.
Rotate passwords before they expire and remove stale saved credentials when they change.
Keep device time synced and domain trust healthy to avoid NTLM/Kerberos failures.
Ask IT for allowlists for critical services like package registries and container registries.
Run curl with your proxy and expected auth method. You should get 200/301/302 from the site, not 407 from the proxy.
Open the site in a private browser window. If you are prompted once and then proceed, the fix worked.
In tools like Git or npm, repeat the original command. If it still fails, enable verbose logging (git -c http.sslVerify=true -c http.verbose=true, npm -ddd) to see whether the request includes Proxy-Authorization.
If you are stuck behind SSO, contact IT with the timestamp, your IP, and the proxy name. Ask them to check logs for denied requests. This is often how to fix HTTP 407 proxy authentication error in managed networks.
The steps above show how to fix HTTP 407 proxy authentication error across devices and tools. Confirm the proxy address, match the auth method, clear bad credentials, and test with curl. If policy or SSO blocks you, work with IT for allowlists and correct PAC rules. That resolves the error fast and keeps your workflow smooth.
What the 407 status means
A 407 status is “Proxy Authentication Required.” Your request reached the proxy, but the proxy blocked it because the request did not include valid authentication. The proxy replies with Proxy-Authenticate headers telling your client which auth methods it accepts (Basic, NTLM, Kerberos, Negotiate). Your client must send a new request with a Proxy-Authorization header or complete a handshake. Key differences:Fast checklist to clear the error
How to fix HTTP 407 proxy authentication error in common tools
This guide shows how to fix HTTP 407 proxy authentication error across browsers, command line tools, and developer workflows. Follow the steps for your platform.Windows
macOS
Linux
Browsers
curl
Git
Node.js and npm
Python and pip
Docker
Package managers and IDEs
Diagnose the root cause
Secure ways to handle credentials
Prevent the error going forward
Verification steps
For more news: Click Here
FAQ
Q: What does a 407 proxy authentication error mean?
A: A 407 status is “Proxy Authentication Required” and means your request reached the proxy but was blocked because it lacked valid authentication. The proxy returns Proxy-Authenticate headers listing accepted methods (Basic, NTLM, Kerberos, Negotiate) and your client must send a Proxy-Authorization header or complete a handshake.
Q: What immediate steps can I take to fix HTTP 407 proxy authentication error quickly?
A: This checklist explains how to fix HTTP 407 proxy authentication error quickly: confirm your proxy username and password, check the proxy address and port, enable the correct system or browser proxy setting, clear cached credentials, and test with curl. If you’re on a corporate network, sign in to VPN or SSO, sync system time for NTLM/Kerberos, and ask IT to allowlist the destination if policy blocks it.
Q: How can I use curl to diagnose and test proxy authentication issues?
A: Use curl to isolate proxy behavior, for example curl -I –proxy http://proxy.company.com:port to test reachability and curl -I –proxy-user user:pass –proxy http://proxy.company.com:port to include credentials. For NTLM use curl -I –proxy-ntlm –proxy-user DOMAINuser:pass –proxy http://proxy:port https://example.com, and if you get 200/301/302 from the site instead of 407 the proxy authentication is working.
Q: Why does the proxy keep prompting me or returning 407 after I enter credentials?
A: Persistent prompts or repeated 407 responses usually come from a wrong proxy address or port, incorrect or expired credentials, or cached/stale saved logins. PAC file rules or policy overrides can also cause a 407 loop if the site is routed incorrectly.
Q: How do I resolve 407 errors on Windows and macOS?
A: On Windows, set the proxy under Settings > Network & internet > Proxy or enable a setup script, remove wrong saved credentials in Credential Manager, sign out and sign back in, and ensure you are logged into your domain account with the clock synced for NTLM/Kerberos. On macOS, configure Proxies in System Settings > Network, enable Web Proxy (HTTP) and Secure Web Proxy (HTTPS), check “Proxy server requires password” and update credentials, and delete stale entries from Keychain Access.
Q: What proxy settings do I need to update for command-line tools like Git, npm, pip, and Docker?
A: For command-line tools, set proxy variables or tool-specific configs such as git config –global http.proxy http://user:pass@proxy.company.com:port and npm config set proxy http://user:pass@proxy.company.com:port, and use pip install package –proxy http://user:pass@proxy.company.com:port for pip. For Docker either configure ~/.docker/config.json proxies or export HTTP_PROXY/HTTPS_PROXY at runtime, and avoid storing plain passwords in .npmrc by using a credential manager when available.
Q: How should I diagnose the root cause if fixes don’t work?
A: Diagnose the root cause by checking error headers with curl -v or browser developer tools and looking for Proxy-Authenticate values to match your client to Basic/NTLM/Kerberos. Confirm reachability by pinging or telnetting to the proxy host and port, review PAC logic and group policies or MDM that may override settings, and if you are stuck behind SSO contact IT with the timestamp, your IP, and the proxy name so they can check logs.
Q: How can I prevent the HTTP 407 proxy authentication error from happening again?
A: To prevent recurrence, document proxy settings, use environment templates for developers and CI, rotate passwords before they expire, remove stale saved credentials, and keep device time synced to avoid NTLM/Kerberos failures. Prefer credential managers or integrated authentication, ask IT for allowlists for critical services, and add company root CAs to trust stores where the proxy uses self-signed certificates.
* The information provided on this website is based solely on my personal experience, research and technical knowledge. This content should not be construed as investment advice or a recommendation. Any investment decision must be made on the basis of your own independent judgement.
Contents
