407 Proxy Authentication Required

The client must authenticate with a proxy before the request can go through.

407 at a glance

Code: 407
Name: Proxy Authentication Required
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 9110, Section 15.5.8
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 407 means

407 Proxy Authentication Required is 401 for proxies: a forward proxy between the client and the internet wants credentials. It comes with Proxy-Authenticate, and the client retries with Proxy-Authorization. The origin server never sees these requests.

What typically causes a 407

Corporate proxies (Squid, Zscaler, Blue Coat, Microsoft proxies using NTLM or Kerberos).
Command-line tools and CI runners configured with HTTP_PROXY but no credentials.

Fix it on the server

Proxy admins: send Proxy-Authenticate with the supported schemes; do not forward Proxy-Authorization upstream.

Fix it as a client or visitor

Put credentials in the proxy URL (http://user:pass@proxy:3128) or use curl --proxy-user.
For NTLM/Kerberos proxies, use a tool that supports them (curl --proxy-ntlm/--proxy-negotiate) or a local helper such as cntlm.

Headers that go with 407

Header	Role
`Proxy-Authenticate`	Required challenge from the proxy.
`Proxy-Authorization`	Client credentials for the proxy.

Example response

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="corp-proxy"
Content-Length: 0