Both HTTP 401 and HTTP 407 handle authentication challenges, but they operate at different hops in the network chain.

Hop difference: Origin vs. Proxy

  • HTTP 401 Unauthorized: Sent by the origin server to demand credentials for accessing a specific API resource. The client responds with the Authorization header.
  • HTTP 407 Proxy Authentication Required: Sent by an intermediary forward proxy (such as a corporate firewall proxy or VPN gateway) before it will permit traffic to leave the network. The client responds with the Proxy-Authorization header.

Header comparison

Stage Origin Server (401) Intermediary Proxy (407)
Challenge WWW-Authenticate: Bearer ... Proxy-Authenticate: Basic ...
Response Authorization: Bearer ... Proxy-Authorization: Basic ...

How to test proxy auth with curl

Supply proxy credentials using -U (--proxy-user):

curl -i -x http://proxy.example.test:8080 -U "proxy_user:proxy_pass" https://api.example.test/v1/health

Key takeaway

HTTP 401 authenticates against the target API server using Authorization, while HTTP 407 authenticates against an intermediary network proxy using Proxy-Authorization.