Proxy authentication explained

How-to·5 min read·Updated 2026-06-27

Before a proxy will route your traffic it has to know the request is yours. There are two standard methods: username and password credentials, or IP whitelisting. Most modern gateways use credentials, because that's also where your targeting parameters live.

Username and password

You send a login and password with each request (your HTTP client and most tools handle this for you). The gateway authenticates you and routes the traffic. This is the portable method — it works from any machine or server without pre-registering its address.

Crucially, the username is also where targeting goes. Parameters like country, city or a sticky session id are appended to the login, so a single credential can request very different exit IPs depending on what you tack on.

IP whitelisting

Instead of credentials, you register the public IP of the machine making requests; the gateway then trusts any traffic from that address. It's convenient for a fixed server because there's nothing to embed in each request.

The catch is mobility: if your IP changes — a new server, a dynamic home connection — you must update the whitelist first, or you're locked out. For dynamic environments, credentials are simpler.

Key takeaways
  • Username/password is the portable default and carries your targeting parameters.
  • IP whitelisting trusts a registered address with no per-request credentials.
  • Targeting (country, city, session) rides inside the username string.
  • Use credentials for dynamic machines; whitelist a fixed, known server.
FAQ

Frequently asked

Is one method more secure?

Both are fine when used correctly. Keep credentials secret and rotate them if leaked; keep your whitelist tight and remove stale IPs. The bigger risk is exposing credentials in client-side code or public repos.

Keep reading

Related guides

Ready to get started?

Pay-as-you-go from crypto checkout, one endpoint for every pool, bandwidth that never expires.