# Proxy authentication

Proxy authentication is how a proxy gateway identifies the customer behind a connection before forwarding it. Two methods dominate: username and password, sent in the Proxy-Authorization header for HTTP proxies or in the SOCKS5 handshake, and IP whitelisting, where connections from registered source addresses are accepted without credentials. Most providers support both and let them coexist.


## Username and password

The client sends `Proxy-Authorization: Basic base64(user:pass)`; a proxy that receives none answers `407 Proxy Authentication Required`. Because the header travels on the connection to the proxy, it works from any source address, including dynamic ones, laptops and serverless functions. On rotating pools the username also carries the [targeting parameters](https://proxshift.com/glossary/username-parameters).


## IP whitelist

You register the public IPv4 addresses of your servers; connections from them are authenticated by origin. No secret leaves your infrastructure, which suits fixed servers and tools that cannot store a password (browser flags, some anti-detect profiles). Parameters still travel in a username, with any password.


## Choosing

|  | Username-password | IP whitelist |
| --- | --- | --- |
| Works from | Anywhere | Registered IPv4 addresses only |
| Secret in transit | Base64 on the proxy connection | None |
| Rotation of credentials | Regenerate the password; old one valid for a grace period | Add or remove addresses |
| Best for | Laptops, containers, serverless, browsers | Fixed servers, anti-detect browsers, Chrome flags |


## How it works at ProxShift

ProxShift accounts hold one credential pair for both gateways, a whitelist of up to 50 IPv4 addresses effective within a minute, and sub-user credentials with their own traffic ceilings. Rotating the password keeps the old one valid for ten minutes.

## Questions

**Is Basic authentication safe on a proxy?**

The credentials are base64, not encrypted, on the hop between you and the proxy. That hop carries no website content in clear text for HTTPS destinations, and the credentials only grant proxy access. Rotate them if a machine that held them is compromised.

Source: https://proxshift.com/glossary/proxy-authentication