407 Proxy Authentication Required
A 407 comes from us, not from the site you were trying to reach. The destination never saw the request.
What it means
We could not match your connection to an account. Either the credentials are wrong, or, far more often, the login string did not parse because a suffix is malformed.
A 401 is a different story entirely: that one comes from the destination and means the site rejected you. If you are seeing 401, the proxy worked.
The usual causes
In order of frequency: a space in a city name instead of a hyphen, a lower-case country code, a TTL value we do not accept, credentials placed inside a field that ignores them, and finally an actually wrong password.
Chromium-based tools deserve special mention. The --proxy-server flag takes a host and port only, so anything before the @ is dropped silently. Puppeteer needs page.authenticate, Playwright needs the username and password fields, and Selenium needs selenium-wire or a generated extension.
Malformed and correct
login_c_us wrong, country code must be upper case
login_c_US_city_New York wrong, space instead of a hyphen
login_c_US_ttl_10m wrong, only 30s, 15m and 1h exist
login_c_US_city_New-York correctIsolating it
Strip the login back to the bare account with no suffixes and try again. If that works, add one suffix at a time until it breaks, and the last one you added is the problem.
Bisecting the login
curl -x login:password@proxy.sotaproxy.com:10000 https://api.ipify.org
curl -x login_c_US:password@proxy.sotaproxy.com:10000 https://api.ipify.org
curl -x login_c_US_s_1_ttl_15m:password@proxy.sotaproxy.com:10000 https://api.ipify.orgWhere credentials get dropped silently
A recurring source of 407 is a tool that accepts a proxy URL containing credentials and then ignores that part. Chromium-based automation is the usual suspect: the launch flag takes a host and a port, and everything before the at sign disappears without a warning.
The three fixes for Chromium tools
# Puppeteer: flag for the address, authenticate for the credentials
args: ["--proxy-server=http://proxy.sotaproxy.com:10000"]
await page.authenticate({ username: "login_c_US", password: "password" });
# Playwright: separate fields, per context
proxy={"server": "http://proxy.sotaproxy.com:10000",
"username": "login_c_US", "password": "password"}
# Selenium: selenium-wire, credentials inside the URL