AI News
04 Aug 2026
Read 12 min
How to Fix 407 Proxy Authentication Error Fast
how to fix 407 proxy authentication error and restore downloads quickly with step-by-step fixes now
Need to get back online? Here’s how to fix 407 proxy authentication error fast: confirm your proxy username and password, re-enter saved credentials, verify the proxy address and port, and test a site with the proxy off. Then update settings in your browser or tools like curl, Git, npm, and pip. Follow the steps below.
A 407 “Proxy Authentication Required” error means your request hit a proxy that needs you to sign in first. The website is fine; the proxy stops you. This can happen on home setups with VPNs, but it is most common on office or school networks. The fix is usually quick once you confirm the right login and settings.
Check you are actually behind a proxy. If you use office Wi‑Fi, VPN, or a school network, you likely are.
Confirm your proxy username and password with IT or your admin. Many 407s come from wrong or expired credentials.
Re-enter credentials. When prompted, type them again. In browsers, close all windows and try once more.
Verify proxy address and port. A common format is http://proxy.company.com:8080. One wrong character breaks it.
Try another site. If some sites work and others do not, the proxy may block categories or need a login portal first.
Temporarily turn off the proxy to test. If the site loads without it, the proxy setup is the cause, not the site.
Restart the app or device. This clears stale auth tokens that can loop a 407.
Open Settings > Network & Internet > Proxy.
If your company uses a setup script (PAC), turn on “Use setup script” and paste the script address.
For manual setup, turn on “Use a proxy server,” enter Address and Port, and click Save.
Open Control Panel > Internet Options > Connections > LAN settings for legacy apps.
Clear saved logins: Start > Credential Manager. Remove old proxy entries and sign in again.
Go to System Settings > Network > select your network > Details > Proxies.
Enable Web Proxy (HTTP) and Secure Web Proxy (HTTPS). Enter server, port, and username/password.
If your org gave a PAC URL, enable Automatic Proxy Configuration and paste the URL.
Open Keychain Access and remove outdated proxy passwords, then re-authenticate.
Desktop: Settings > Network > Network Proxy. Set Manual or Automatic (PAC) as given by IT.
Shell: export HTTP_PROXY=http://user:pass@proxy:port and HTTPS_PROXY=http://user:pass@proxy:port. Add NO_PROXY for domains to skip (for example, export NO_PROXY=localhost,127.0.0.1,.company.com).
Persist variables in ~/.bashrc, ~/.zshrc, or /etc/environment if system-wide.
They use the system proxy. Set it in OS settings as above.
When prompted, enter your domain credentials if your company uses single sign-on.
If you loop on 407, close all browser windows, then reopen and try again.
Clear auth cache: go to chrome://net-internals/#dns and click Clear host cache (helps in some cases).
Go to Settings > General > Network Settings > Settings.
Select Auto-detect, Use system proxy, or Manual proxy per your network.
If Manual, enter HTTP Proxy and port, check “Use this proxy server for all protocols,” add exceptions under “No Proxy.”
Restart Firefox and sign in when prompted.
Command with proxy: curl -x http://proxy:port https://example.com
Add credentials: curl -x http://user:pass@proxy:port https://example.com
For Windows Integrated Auth: curl –proxy-ntlm -x http://proxy:port https://example.com
If your org uses Kerberos: curl –proxy-negotiate –proxy-user : -x http://proxy:port https://example.com
Set proxy: git config –global http.proxy http://user:pass@proxy:port
For HTTPS: git config –global https.proxy http://user:pass@proxy:port
Bypass for your Git server: git config –global http.https://git.company.com.proxy “”
Set: npm config set proxy http://user:pass@proxy:port
Set: npm config set https-proxy http://user:pass@proxy:port
Bypass local: npm config set noproxy “localhost,127.0.0.1,.company.com”
Remove old values if needed: npm config delete proxy and npm config delete https-proxy
Use: pip install package –proxy http://user:pass@proxy:port
Config file (pip.conf or pip.ini) can store the proxy to avoid typing it each time.
Java apps often read HTTPS_PROXY/HTTP_PROXY/NO_PROXY environment variables.
Docker: set proxy vars in the Docker service config and in /etc/systemd/system/docker.service.d/http-proxy.conf.
PowerShell: [System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy(“http://proxy:port”) (for older scripts).
If your company uses Windows Integrated Auth (NTLM/Kerberos), make sure your tool supports it. Use flags like –proxy-ntlm or –proxy-negotiate in curl, or rely on browsers that support SSO.
Some networks require a first-time login in a browser portal. Open a non-HTTPS site like http://example.com to trigger it, sign in, then try again.
If SSL inspection is on, ensure your device trusts the company root certificate. While 407 is about auth, untrusted certs can still block the handshake after you authenticate.
Your account may be locked, expired, or out of quota. Ask IT to check directory and proxy logs.
The proxy may only allow certain apps. Share the app name, URL, and timestamp so they can whitelist it.
Provide a full error sample with headers if you can. The “Proxy-Authenticate” header reveals what auth type the proxy expects.
Do not paste passwords into shared terminals or screenshots.
Prefer using a password prompt over hardcoding credentials in config files.
Use NO_PROXY for trusted internal hosts to reduce load and avoid auth loops.
Remove saved proxy credentials from old laptops or scripts after you leave a network.
You now know how to fix 407 proxy authentication error quickly: confirm credentials, set the right proxy and port, reauthenticate in your browser or tool, and match the proxy’s auth method. If issues remain, test without the proxy to isolate the cause, then share clear details with your admin for a fast unblock.
How to Fix 407 Proxy Authentication Error: Quick Wins
What the 407 Status Means
A 401 error comes from the website. A 407 comes from the proxy in the middle. The proxy replies with “Proxy-Authenticate” headers that tell your app which login method it accepts (Basic, Digest, NTLM, Kerberos). Your app must send a “Proxy-Authorization” header next time. Understand this flow, and you can plan how to fix 407 proxy authentication error on your device.Set the Proxy Correctly on Your System
Windows
macOS
Linux
Fix It in Browsers
Chrome and Edge (Windows/macOS)
Firefox
Fix It in Popular Developer Tools
Use the steps below to learn how to fix 407 proxy authentication error in common apps.curl
Git
npm / Node.js
pip / Python
Other tools
Handle NTLM, Kerberos, and Captive Portals
When It’s Not You: Check the Proxy
Security Tips While You Fix
For more news: Click Here
FAQ
Q: What does a 407 “Proxy Authentication Required” error mean?
A: A 407 means your request hit a proxy that requires you to sign in before it will forward traffic. The proxy returns Proxy-Authenticate headers telling your app which login method it accepts (Basic, Digest, NTLM, Kerberos), and your app must send a Proxy-Authorization header next time.
Q: What are the fastest steps to resolve a 407 error?
A: To quickly learn how to fix 407 proxy authentication error, confirm you are behind a proxy, verify and re-enter your proxy username and password, and check the proxy address and port. Also test a site with the proxy off and restart the app or device to clear stale auth tokens.
Q: How do I set or clear proxy credentials on Windows?
A: On Windows open Settings > Network & Internet > Proxy and either enable Use setup script and paste the PAC URL or turn on Use a proxy server to enter the address and port; legacy apps use Control Panel > Internet Options > Connections > LAN settings. Clear saved logins via Start > Credential Manager, remove old proxy entries, then sign in again.
Q: How do I configure a proxy on macOS and remove outdated passwords?
A: On macOS go to System Settings > Network > select your network > Details > Proxies, enable Web Proxy (HTTP) and Secure Web Proxy (HTTPS), and enter the server, port, and username/password or enable Automatic Proxy Configuration for a PAC URL. Open Keychain Access to remove outdated proxy passwords and then re-authenticate.
Q: What shell variables should I set on Linux to route traffic through a proxy?
A: In a shell export HTTP_PROXY=http://user:pass@proxy:port and HTTPS_PROXY=http://user:pass@proxy:port, and add NO_PROXY for domains to skip (for example, export NO_PROXY=localhost,127.0.0.1,.company.com). Persist those variables in ~/.bashrc, ~/.zshrc, or /etc/environment if you need system-wide settings.
Q: How do I include proxy credentials for curl, Git, npm, and pip?
A: In curl include the proxy and credentials: curl -x http://user:pass@proxy:port https://example.com, and use –proxy-ntlm or –proxy-negotiate if your org requires NTLM/Kerberos. For Git set git config –global http.proxy http://user:pass@proxy:port (and https.proxy for HTTPS), and for npm use npm config set proxy http://user:pass@proxy:port and npm config set https-proxy http://user:pass@proxy:port; for pip run pip install package –proxy http://user:pass@proxy:port or store the proxy in pip.conf/pip.ini.
Q: What should I do if my network uses NTLM, Kerberos, or a captive portal?
A: If your company uses Windows Integrated Auth make sure your tool supports NTLM or Kerberos and use flags like –proxy-ntlm or –proxy-negotiate in curl, or rely on browsers that support single sign-on. For captive portals open a non-HTTPS site like http://example.com to trigger the login portal and sign in, and ensure your device trusts the company root certificate if SSL inspection is in place.
Q: When should I involve IT or the proxy administrator to resolve a persistent 407 error?
A: If re-entering credentials, verifying settings, and testing without the proxy do not fix the issue contact IT because your account may be locked, expired, or out of quota and they can check directory and proxy logs. Provide them the app name, URL, timestamp and a full error sample with headers so they can see the Proxy-Authenticate header and determine the expected auth type.
Contents
