Documentation menu

Integrate · Errors & troubleshooting

Every status the gateway can answer with, and what to change.

Gateway errors come with a short reason in the body. Target errors pass through untouched. Telling the two apart is most of troubleshooting.

4 min read 5 sections Updated Sep 21, 2026

Responses from the gateway#

StatusReason in the bodyCauseFix
407 Proxy Authentication Requiredinvalid_credentialsWrong username or password, or the connecting IP is not whitelisted and no credentials were sentCopy the pair from the dashboard again; check the whitelist against curl https://api.ipify.org run without a proxy
400 Bad Requestinvalid_parameter: …A username parameter is unknown or malformed, or the combination is invalid (-state- outside the US, -city- without -cc-)Fix the string named in the body; see Targeting & sessions
402 Payment Requiredinsufficient_balanceNo traffic left on the pool network you are using, or the sub-user reached its limitBuy traffic or raise the sub-user limit; check GET /v1/balance
403 Forbiddenblocked_destinationThe destination or port is not allowed (port 25, or a target on our deny list), or the account is suspendedRead the reason; contact us if you believe a destination is wrongly listed
502 Bad Gatewayno_exit_available / exit_failedNo device online for the parameters, or the chosen device dropped mid-requestRetry once (rotation already picks another exit); broaden the targeting if it repeats
504 Gateway Timeouttarget_timeoutThe target did not answer through the exit within the time limitRetry with a new IP; raise your client timeout if the target is slow by nature

Gateway error or target error?#

A gateway error arrives before any byte from the target: on an HTTPS request it is the response to the CONNECT, which most clients surface as a connection or proxy error rather than an HTTP response. A target error arrives inside the tunnel with the target's own headers and body. curl -v shows the difference immediately: look at which response follows CONNECT.

Diagnostic checklist#

  1. Run the simplest request: curl -x http://USER:[email protected]:9000 https://api.ipify.org with no parameters. If it works, the problem is in a parameter or in your client.
  2. Check the proxy scheme: the proxy URL starts with http:// (or socks5h:// on 9001), never https://, even for HTTPS targets.
  3. Add parameters back one at a time. 400 names the bad one; 502 on a narrow combination means nobody is online there right now.
  4. Whitelist users: compare the address in Settings → Whitelist with the output of curl https://api.ipify.org without proxy, run on the same machine. Cloud instances often egress through a NAT gateway with a different address.
  5. Check the balance of the network you are actually using: residential and mobile traffic are separate balances.
  6. Look for environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY) that override what you pass in code.
  7. If the TLS certificate fails to verify, something between you and the gateway intercepts TLS (corporate proxy, antivirus). The gateway never touches certificates.

Symptoms and their usual cause#

You seeUsually meansDo this
curl: (56) Received HTTP code 407 from proxy after CONNECTCredentials rejectedRe-copy them; percent-encode special characters if you set your own password
The same IP on every requestYour client reuses one keep-alive connection, or you left a -sid- in the usernameClose connections between requests or drop the session id
A different IP on every request although -sid- is setThe lifetime is shorter than the gap between requests, or the id changes per request (a random value in a template)Fix the id, raise -ttl-
Connection reset by peer mid-downloadThe household went offlineRetry; with rotation it already uses another exit; on a sticky session the next request gets a new IP
Works in curl, fails in the browserThe browser has no proxy password or the flag ignores credentialsUse Playwright or Puppeteer authentication, or the whitelist
Target answers 403 or a CAPTCHAThe target scores the visit, not the proxyMove to residential or mobile, add a sticky session for multi-step flows, match headers to the exit country, pace per domain
Everything is slowDistant exit or a household on a weak lineChoose the country closest to the target, keep sessions short so the next one lands on a better line, or use datacenter or ISP for raw speed
SSL certificate problemTLS interception on your sideRemove the interception or trust its root; the gateway is not involved

Still stuck#

Send us the exact request (credentials removed), the timestamp in UTC, the status and body you received and the exit IP if the request went through. The contact page explains how to reach the team; account holders open a ticket from the dashboard.

Ready when you are

Paste the endpoint, watch the exit change.

Create your account, top up $10 and run the quickstart against your real target. What you do not use stays on your balance.