Username and password#
The client sends Proxy-Authorization: Basic base64(user:pass); a proxy that receives none answers 407 Proxy Authentication Required. Because the header travels on the connection to the proxy, it works from any source address, including dynamic ones, laptops and serverless functions. On rotating pools the username also carries the targeting parameters.
IP whitelist#
You register the public IPv4 addresses of your servers; connections from them are authenticated by origin. No secret leaves your infrastructure, which suits fixed servers and tools that cannot store a password (browser flags, some anti-detect profiles). Parameters still travel in a username, with any password.
Choosing#
| Username-password | IP whitelist | |
|---|---|---|
| Works from | Anywhere | Registered IPv4 addresses only |
| Secret in transit | Base64 on the proxy connection | None |
| Rotation of credentials | Regenerate the password; old one valid for a grace period | Add or remove addresses |
| Best for | Laptops, containers, serverless, browsers | Fixed servers, anti-detect browsers, Chrome flags |
How it works at ProxShift#
ProxShift accounts hold one credential pair for both gateways, a whitelist of up to 50 IPv4 addresses effective within a minute, and sub-user credentials with their own traffic ceilings. Rotating the password keeps the old one valid for ten minutes.
Questions people ask#
Is Basic authentication safe on a proxy?
The credentials are base64, not encrypted, on the hop between you and the proxy. That hop carries no website content in clear text for HTTPS destinations, and the credentials only grant proxy access. Rotate them if a machine that held them is compromised.