407 Proxy Authentication Required

407 Proxy Authentication Required is the proxy-layer counterpart to 401: it means an intermediary proxy between the client and the origin server needs authentication before it will forward the request further. RFC 9110 requires the proxy to send a Proxy-Authenticate header naming an acceptable scheme, and the client is expected to retry with a Proxy-Authorization header carrying credentials for that proxy specifically, separate from any Authorization header intended for the origin server.

This shows up almost exclusively in environments with a mandatory forward proxy: corporate networks that route all outbound traffic through an authenticating gateway, some VPN configurations, and certain enterprise API testing setups. It is distinct from a normal 401, which concerns the origin server's own authentication; a request can pass proxy authentication and still receive a 401 from the destination server, or vice versa.

Debugging 407s in practice usually means checking the client's or the system's proxy configuration rather than the application's own authentication logic, since many HTTP libraries need proxy credentials configured completely separately from any request-level Authorization header meant for the origin server, and some authentication schemes that proxies rely on, such as NTLM or Kerberos/Negotiate, require a multi-step handshake that simple HTTP clients don't implement by default, which produces failures that look more like a stuck connection than a clean, obvious 407.