Security

What is Username Authentication?

Username authentication identifies a proxy client with a username and password rather than by its IP address. HTTP proxies carry the credential in a Proxy-Authorization header, and SOCKS5 negotiates it during the handshake. Most providers also encode routing instructions - country, session identifier, rotation behaviour - inside the username string, so one endpoint can serve many configurations.

An HTTP client sends Proxy-Authorization: Basic followed by the base64 encoding of user:password, either up front or after the proxy answers 407 with a Proxy-Authenticate header naming the scheme. Base64 is encoding rather than protection, so the credential is readable to anything watching the hop between client and proxy unless that hop is itself encrypted. SOCKS5 handles the same job differently. The client advertises the username/password method in its greeting, the proxy selects it, and a short sub-negotiation defined in RFC 1929 carries the two strings before any connect request goes out.

Nearly every tool accepts the compact form http://user:pass@host:port, and nearly every team eventually gets bitten by punctuation inside it. A password containing @, :, / or # breaks the parse and has to be percent-encoded, so @ becomes %40, or the library will read half your password as a hostname. curl takes -x for the proxy and -U for the credential, which keeps the secret out of the URL while still exposing it in the process list on a shared machine. Environment variables such as HTTPS_PROXY accept the same userinfo syntax.

Providers overload the username field because it is the one string every client can pass. A username assembled from an account name plus tokens - a country code, a city, a session identifier, a rotation flag - tells the gateway how to route that connection, so a single host and port covers every combination without issuing new endpoints. Change the session token and the exit IP changes with it; keep the token and you hold the same address for as long as the provider allows. Read the separator rules carefully, since a hyphen inside your account name can be parsed as a token boundary.

Credentials travel, which is both the advantage and the exposure. One pair works from a laptop, a CI runner and a colleague's machine, so it ends up in shell history, container logs, a committed .env file and a screenshot pasted into a support ticket. Rotate the pair when people leave, and use a separate sub-user per project where the provider supports it. Check whether traffic is billed per credential, because that is what lets you trace an unexpected bandwidth spike back to the job that caused it.

Where you meet it

This is the field you fill in inside an antidetect browser profile, a Scrapy middleware or a Playwright launch option, and it is where most first-hour proxy problems live. A 407 means the gateway received a credential it rejected. A connection that opens but exits in the wrong country usually means a geo or session token in the username is malformed and the provider fell back to a default. Copy the string from the dashboard instead of retyping it.

Common questions

What does 407 Proxy Authentication Required mean?

The proxy either received no credential or rejected the one it got. Confirm the client is sending Proxy-Authorization at all, check that reserved characters in the password are percent-encoded, and verify the username matches the format the provider expects, including any country or session tokens appended to the account name.

Can I use special characters in a proxy password?

Yes, though not unescaped inside a URL. Characters such as @, :, / and # carry meaning in the userinfo section and have to be percent-encoded, or the parser will misread where the password ends. Passing credentials through the client's dedicated option instead of the URL avoids the problem entirely.

Does SOCKS5 support username and password authentication?

Yes. The client advertises the username/password method during the initial greeting, the proxy selects it, and the credential is exchanged in a short sub-negotiation described in RFC 1929, before any connection request. SOCKS4 has no equivalent, carrying only a userid field with no password, which is one reason SOCKS5 replaced it.

Related terms

IP Authentication
IP authentication authorizes a proxy client by the source address of its connection instead of a credential. You register the public IP of the machine that will connect, and the provider's gateway accepts sessions from it while refusing the rest. There is no Proxy-Authorization header to send and no password sitting in a config file.
Anonymity
Anonymity, in proxy terms, is how much a destination server can learn about the client behind a connection. Proxy listings grade it by whether the proxy forwards your real IP or announces itself in request headers, though DNS, WebRTC and TLS details can give away the same information a header would.
Anonymous Proxy
An anonymous proxy hides the client's real IP address from the destination server but still identifies itself as a proxy, typically through a Via or Proxy-Connection header. The site learns that an intermediary is in the path and can act on that, without ever learning where the request originated.
Elite Proxy
An elite proxy, also called a high-anonymity or level 1 proxy, forwards requests without adding Via, X-Forwarded-For or any other header that reveals an intermediary. To the destination server the traffic reads as an ordinary direct connection from the proxy's own IP address. That address can still be classified.
Transparent Proxy
A transparent proxy intercepts traffic without any client configuration and passes the client's real IP to the destination, usually in an X-Forwarded-For header alongside Via. ISPs, schools and corporate networks deploy them for caching and content filtering. They give the user no privacy and are visible to any server that reads headers.
IP Reputation
IP reputation is the trust score a website, mail server or anti-bot system assigns to an IP address based on the traffic it has produced before. Spam complaints, request patterns, past abuse reports, hosting type and ASN ownership all feed that score. A poor one earns CAPTCHAs where a good one passes, or a refusal with no explanation.
Blacklist
A blacklist is a list of IP addresses, domains or ranges that a service refuses or restricts. Public DNS blacklists such as Spamhaus target mail abuse, while anti-bot vendors, CDNs and individual sites keep private ones. An address lands on a list after abuse reports, spam or automated traffic, and removal ranges from automatic expiry to a manual delisting request.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary