Proxy error reference · HTTP status codes

401 Unauthorized vs 407 Proxy Authentication Required

Q: Where do proxy credentials go in an HTTP request?

In the Proxy-Authorization header, which your client builds from the user:password@ part of the proxy URL. The website never sees that header, because the proxy removes it. Website credentials go in the Authorization header or a cookie, which the proxy passes through untouched.

HTTP status code (4xx, client error): the exact message in each tool, the likely causes in order, and the fix that works.

Last updated: October 13, 2026 · 4 min read

Quick answer

What does 401 Unauthorized vs 407 mean with a proxy?

A 401 Unauthorized comes from the website; a 407 comes from the proxy. If you scrape through CrawlRelay residential proxies and get 401, the proxy accepted you and the website is asking for its own login or API key. Proxy credentials do not help there. Fix 407 in your proxy URL, and handle 401 according to the site's rules for its protected content.

401 Unauthorized vs 407 at a glance

Error	401 Unauthorized vs 407
Type	HTTP status code (4xx, client error)
Sent by	The target website, never the proxy
Defined in	RFC 9110, section 15.5.2 (compare 407: section 15.5.8)
Retry it?	No. A 401 asks for credentials for the website itself
First check	Check which server sent it: the website (401) or the proxy (407)

What does 401 Unauthorized vs 407 mean?

RFC 9110 pairs the two codes. A 401 carries a WWW-Authenticate header and asks for credentials for the origin server. A 407 carries a Proxy-Authenticate header and asks for credentials for the proxy. The answers go in different headers too: Authorization for the site and Proxy-Authorization for the proxy.

Mixing them up is common because both say 'authentication'. The quickest test is the status code itself: 401 means you got through the proxy.

What does a 401 look like in Python, curl, Node.js and browsers?

The same failure prints differently in every tool. These are the messages to search your logs for:

Python requests: status_code == 401 with a WWW-Authenticate header (website) versus a ProxyError mentioning 407 (proxy)
curl: HTTP/2 401 after a successful CONNECT (website) versus CONNECT tunnel failed, response 407 (proxy)
APIs: a JSON body such as {"message": "Unauthorized"} or an invalid-token message

What causes a 401?

Most likely first:

The page or API needs a login or a key. The site, not the proxy, is asking.
Proxy credentials in the wrong place, such as an Authorization header meant for the proxy, which the site rejects.
An expired session cookie or token in a multi-step flow.
A token tied to an IP or region, so a new exit invalidates it.

How do I diagnose a 401 step by step?

Confirm the code: 401 is the site, 407 is the proxy.
Run the curl test below. If you see HTTP/1.1 200 Connection established before the 401, the proxy is fine.
Check whether the same URL needs a login in a normal browser.
In a multi-step flow, check whether the 401 starts when the exit IP changes.

Test the failing URL with curl (HTTP port, verbose)

# Use the URL that fails; with https://api.ipify.org instead, you test the gateway alone.
# "HTTP/1.1 200 Connection established" first, then the site's own status: the site answered.
curl -v -x http://USERNAME:[email protected]:7777 https://TARGET_URL

# Same test through the SOCKS5 port, with DNS resolved at the exit
curl -v --socks5-hostname gw.crawlrelay.com:7778 --proxy-user USERNAME:PASSWORD https://TARGET_URL

How do I fix a 401?

For proxy problems (407), put credentials in the proxy URL or the client's proxy settings, never in an Authorization header.
For a public API that needs a key, register with the site and send its key as documented.
For sessions tied to an IP, use a sticky session for the whole flow.
For content behind a login, check the site's terms before automating it. Scraping accounts you do not own, or personal data behind logins, is outside our Acceptable Use Policy.

Should I retry after a 401?

Do not retry a 401 blindly. It asks for something your request does not have. Refresh the token or the session if your flow has one, then try once. Repeated 401s mean the content is not public or your access has ended.

How does 401 Unauthorized vs 407 apply to CrawlRelay?

An HTTP proxy reports its own credential problems with 407 or a failed tunnel, not with 401. If you see 401 while using the CrawlRelay gateway, your request reached the website, which narrows the problem down fast.

Gateway: gw.crawlrelay.com, port 7777 (HTTP, HTTPS through CONNECT) and port 7778 (SOCKS5). Username format: USERNAME-country-{cc}-state-{state}-city-{city}-zip-{zip}-asn-{asn}-session-{id}-ttl-{minutes}. Related: 407 Proxy Authentication Required · 403 Forbidden · Sessions guide.

401 Unauthorized vs 407: questions developers ask

Why do I get 401 when my proxy password is correct?

Because 401 is about the website, not the proxy. Your proxy login worked, and the site wants its own credentials, such as an API key, a login cookie or a token. Check the site's documentation. If the content is behind a login you are not entitled to, do not automate it.

Can a sticky session fix 401 errors?

Sometimes. Some sites bind a session or token to the IP that created it, so a new exit makes the token invalid and the site answers 401. Keeping one sticky session for the whole flow avoids that. It does not help when the content needs credentials you do not have.

Where do proxy credentials go in an HTTP request?

In the Proxy-Authorization header, which your client builds from the user:password@ part of the proxy URL. The website never sees that header, because the proxy removes it. Website credentials go in the Authorization header or a cookie, which the proxy passes through untouched.

Other proxy errors in this reference

HTTP status codes

Browser and client errors

Connection and TLS errors

Residential proxies with docs that cover the failure cases

CrawlRelay residential proxies from $0.50/GB, traffic that never expires.

See pricing Quick start