What is a 407 error in web scraping?

A 407 Proxy Authentication Required means your proxy refused the request because the credentials were missing, malformed or wrong. The target website never saw it. This is the one status code in scraping that says nothing about the site you were trying to reach.

That makes it the easiest failure in this list to fix, and the easiest to misdiagnose. It looks like a block, so people reach for residential IPs or a headless browser, when the actual problem is a username and password that never got sent.

Telling a 407 from a real block

A 403 comes from the target site and means it decided not to serve you. A 407 comes from the proxy in between and means it decided not to forward you. Two quick checks separate them:

• Try without the proxy. If the request succeeds directly and fails through the proxy, it is a 407 problem, not a site problem.
• Check which host answered. A 407 response typically carries a Proxy-Authenticate header naming the proxy's authentication scheme. A 403 from a site carries the site's own headers, often with its anti-bot vendor visible.

What actually causes it

In rough order of how often it turns out to be the answer:

• Credentials not sent. The most common cause. Many HTTP clients will not send proxy credentials unless they are embedded in the proxy URL itself, in the form http://user:pass@host:port.
• Special characters in the password. A password containing @, :, / or # breaks the proxy URL unless it is percent-encoded. This one is worth checking early, because the symptom looks exactly like a wrong password.
• Wrong port. Providers often expose different ports for different behaviours, such as rotating against sticky sessions. Some ports expect a different credential format.
• Credentials in the wrong place. Sending Authorization instead of Proxy-Authorization authenticates you to the destination, not the proxy.
• IP allowlisting. If the provider authenticates by source IP rather than by password, requests from a new machine get a 407 until that address is added.
• Exhausted plan. Some providers return 407 rather than 402 when bandwidth runs out.

Where Zenrows fits

Zenrows Fetch takes an API key on the request rather than proxy credentials, so this failure mode does not exist in the normal path. When you need residential IPs you set premium_proxy as a parameter and the routing is handled for you, with country targeting as another parameter rather than another endpoint and another password. If you are using the legacy residential proxy endpoints directly, the proxy troubleshooting guide covers credential and geolocation failures specifically.