407 Proxy Authentication Required

RFC 9110, section 15.5.8, describes 407 as the proxy version of 401. The proxy must send a Proxy-Authenticate header with its challenge, and the client answers with Proxy-Authorization. Keeping these separate from WWW-Authenticate and Authorization lets a request carry credentials for the proxy and for the origin at the same time.

Browsers handle 407 by showing a proxy login dialog, or by using the operating system credentials (NTLM or Kerberos in Windows domains). Tools like npm, pip, git, curl and Docker do not share that session, so they fail with 407 until the proxy credentials are set in their own configuration or in the HTTP_PROXY and HTTPS_PROXY environment variables. For HTTPS URLs the 407 arrives in reply to the CONNECT request that opens the tunnel.

If you are visiting the site

• Your company or school network routes traffic through an authenticating proxy and your password changed or expired.
• Proxy settings in the browser or operating system point to a proxy that needs a login you have not entered.

If you run the server

• CLI tools and CI runners use HTTP_PROXY without credentials, or with a password containing characters such as @ or # that were not percent-encoded in the URL.
• The proxy only supports NTLM or Kerberos, which many tools cannot do without a local helper proxy.
• Docker builds do not inherit the host proxy settings, so RUN steps that download packages fail.

If you are visiting the site

• Enter your network credentials when the browser asks, or ask IT whether your account is locked.
• If you are not on a corporate network, remove the proxy from your system settings.

If you run the server

• Set HTTP_PROXY and HTTPS_PROXY as http://user:password@proxy.example.com:3128, percent-encoding special characters in the password.
• Configure tools that ignore the environment: npm config set proxy, git config --global http.proxy, pip --proxy.
• For NTLM-only proxies, run a local relay such as Cntlm and point tools at it.
• Pass proxy variables to Docker builds with --build-arg HTTP_PROXY=... or in the Docker client config.

Applications do not send 407; forward proxies do (Squid with an auth_param helper and http_access deny !authenticated, for example). The commands below reproduce it and pass credentials.

# See the 407 and the challenge
curl -sv -x http://proxy.example.com:3128 https://example.com 2>&1 | grep -iE "407|proxy-authenticate"

# Send proxy credentials
curl -x http://proxy.example.com:3128 -U alice:s3cret https://example.com

# Most CLI tools read these
export HTTPS_PROXY="http://alice:s3cret@proxy.example.com:3128"
export HTTP_PROXY="$HTTPS_PROXY"

407 vs 401

401 comes from the website and uses WWW-Authenticate; 407 comes from a proxy in the middle and uses Proxy-Authenticate.

407 vs 511

511 is sent by captive portals on hotel or airport Wi-Fi asking you to log in to the network through a web page; 407 is an HTTP-level proxy challenge.

How do I fix 407 Proxy Authentication Required in npm or pip?

Give the tool the proxy credentials: npm config set proxy http://user:pass@proxy:3128 (and https-proxy), or pip install --proxy http://user:pass@proxy:3128. Percent-encode special characters in the password.

Why does the browser work but git or curl returns 407?

The browser authenticates to the proxy with your Windows or macOS session, often via NTLM or Kerberos. Command-line tools do not share it, so they need credentials in HTTPS_PROXY or their own config.

Is 407 an error from the website I am visiting?

No. The request never reached the website. A proxy on your side of the connection stopped it.