Qaynaq LABS · TOOLS

HTTP · 4xx Client Error

407 Proxy Authentication Required

Client must authenticate with a proxy before accessing the requested resource.

When you see this status

  • Client sends request through a proxy requiring authentication
  • Proxy rejects request due to missing or invalid credentials
  • Proxy requires credentials for the target resource

Common causes

  • Missing Proxy-Authorization header
  • Invalid Proxy-Authorization credentials
  • Proxy configured to require authentication
  • Client ignores proxy authentication challenge

How to debug it

  1. Verify proxy requires authentication
  2. Check Proxy-Authorization header format
  3. Validate credentials with proxy administrator
  4. Inspect proxy logs for authentication failure

Return this code in your framework

Express (Node.js)
res.status(407).set('Proxy-Authenticate', 'Basic realm="proxy"').send('Proxy auth required');
FastAPI (Python)
@app.get('/')
async def root(request: Request):
    return Response(status_code=407, headers={"Proxy-Authenticate": "Basic"}, content="Proxy auth required")
NestJS
@Get()
proxyAuth(@Res() res: Response) {
  res.status(407).set('Proxy-Authenticate', 'Basic').send('Proxy auth required');
}
Go (net/http)
http.Error(w, "Proxy auth required", 407)
w.Header().Set("Proxy-Authenticate", "Basic")

About HTTP 407

HTTP status code 407 Proxy Authentication Required is part of the 4xx Client Error family. Client must authenticate with a proxy before accessing the requested resource. Understanding it is essential for backend engineers, API designers, and anyone debugging integrations between services.

The Qaynaq Labs HTTP Status Code Explainer covers all standard codes with practical guidance: what triggers them, how to debug them in production, and exactly how to return them from common frameworks. Each code page is hand-curated and verified.

Frequently asked

How is 407 different from 401?

401 is for origin server authentication; 407 is specifically for proxy authentication. Both require a challenge-response mechanism.

What should the Proxy-Authenticate header contain?

Typically 'Basic' or 'Digest' followed by realm, e.g., 'Basic realm="proxy"'. The exact value depends on proxy configuration.

Can a client retry a 407 request?

Yes, but must include valid Proxy-Authorization credentials. Infinite retries may trigger proxy rate limiting.