Security

What is IP Authentication?

IP authentication authorizes a proxy client by the source address of its connection instead of a credential. You register the public IP of the machine that will connect, and the provider's gateway accepts sessions from it while refusing the rest. There is no Proxy-Authorization header to send and no password sitting in a config file.

The gateway compares the source address of an incoming TCP connection against the addresses on your account before any proxy-level authentication step happens. An HTTP proxy that would otherwise answer 407 Proxy Authentication Required goes straight to handling the request or the CONNECT tunnel. A SOCKS5 gateway selects the no-authentication method during its handshake rather than asking for a username and password. On the client side the proxy URL loses its userinfo section and becomes host and port alone, which is how tools that cannot express credentials at all end up using this method.

Most failures are address mismatches. The IP your browser reports belongs to your laptop, a container leaves through the host's NAT, an autoscaling group leaves through a NAT gateway whose address you have to pin, and a dual-stack machine may prefer IPv6 while your entry lists a v4 address. Run the check from the connecting machine itself, using a plain request to an echo endpoint, and register precisely what it reports. A recreated cloud NAT gateway often comes back with a different address.

The credential here is a network position, so it belongs to whoever occupies that position. Anything behind the same egress can use your proxy account without knowing a thing about it, whether that is another tenant, a colleague on the office connection or a compromised container on the same host, and the bandwidth is billed to you. On a dedicated server you control, that risk is small. On a shared exit it is a poor fit, which is part of why providers cap how many addresses an account may register.

A stale entry produces symptoms that look like a network fault rather than an authentication failure - connections that hang or return a generic refusal instead of a clear 407, because the gateway has no reason to invite a retry from an address it does not recognise. Check the registered list first whenever a working setup breaks after a server migration or a firewall rewrite. Many providers accept both methods on one account, so a fixed worker can use IP authentication while ad-hoc runs use credentials.

Where you meet it

This is the setting you configure once when a scraping box or an automation server moves into production and you would rather not ship a password to it. It is also the reason a deploy breaks. A new instance leaves through a new egress address, and every request comes back refused with no useful error. Keep the registered addresses alongside the rest of your infrastructure configuration, and re-check them after anything that touches networking or scaling.

Common questions

IP authentication or username and password - which should I use?

Use IP authentication for a server with a stable public address, since it removes a secret from your configuration. Use credentials for anything that moves, runs from several locations, or needs routing parameters such as country and session identifiers, which providers encode in the username and which IP-based access cannot express.

Why does IP authentication fail even though I added my address?

The gateway is almost certainly seeing a different address. Verify from the connecting machine rather than your desktop, look for NAT gateways or load balancers rewriting the source, confirm the host is not preferring IPv6, and allow a short propagation delay before assuming the entry is wrong.

Is IP authentication secure?

It removes a stealable secret and replaces it with a location, which is a fair trade on hardware you control. On a shared egress it authorises everyone behind that address, and it gives you no per-user accountability, so pair it with a dedicated server or use credentials where several people and machines are involved.

Related terms

Whitelist
A whitelist is an explicit list of IP addresses, ranges or identities that a system allows, with everything else denied by default. Firewalls, admin panels, API gateways, database hosts and proxy providers all use them. On the proxy side, whitelisting your server's public IP lets it connect without sending a username and password.
Username Authentication
Username authentication identifies a proxy client with a username and password rather than by its IP address. HTTP proxies carry the credential in a Proxy-Authorization header, and SOCKS5 negotiates it during the handshake. Most providers also encode routing instructions - country, session identifier, rotation behaviour - inside the username string, so one endpoint can serve many configurations.
Anonymity
Anonymity, in proxy terms, is how much a destination server can learn about the client behind a connection. Proxy listings grade it by whether the proxy forwards your real IP or announces itself in request headers, though DNS, WebRTC and TLS details can give away the same information a header would.
Anonymous Proxy
An anonymous proxy hides the client's real IP address from the destination server but still identifies itself as a proxy, typically through a Via or Proxy-Connection header. The site learns that an intermediary is in the path and can act on that, without ever learning where the request originated.
Elite Proxy
An elite proxy, also called a high-anonymity or level 1 proxy, forwards requests without adding Via, X-Forwarded-For or any other header that reveals an intermediary. To the destination server the traffic reads as an ordinary direct connection from the proxy's own IP address. That address can still be classified.
Transparent Proxy
A transparent proxy intercepts traffic without any client configuration and passes the client's real IP to the destination, usually in an X-Forwarded-For header alongside Via. ISPs, schools and corporate networks deploy them for caching and content filtering. They give the user no privacy and are visible to any server that reads headers.
IP Reputation
IP reputation is the trust score a website, mail server or anti-bot system assigns to an IP address based on the traffic it has produced before. Spam complaints, request patterns, past abuse reports, hosting type and ASN ownership all feed that score. A poor one earns CAPTCHAs where a good one passes, or a refusal with no explanation.
Blacklist
A blacklist is a list of IP addresses, domains or ranges that a service refuses or restricts. Public DNS blacklists such as Spamhaus target mail abuse, while anti-bot vendors, CDNs and individual sites keep private ones. An address lands on a list after abuse reports, spam or automated traffic, and removal ranges from automatic expiry to a manual delisting request.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary