407 — Proxy Authentication Required

The proxy accepted the connection and then refused to forward it because the credentials were missing, malformed or unknown. Nothing was sent to the target site, and on a metered proxy nothing was billed. The proxy itself, before your request ever reaches the target.

The username or password is wrong — most often a typo in a geo token, which makes the whole username unknown rather than the geo invalid. The credentials were put in the URL but the client strips them. Scrapy does exactly this, which is why it needs a Proxy-Authorization header instead. A special character in the password was not percent-encoded, truncating the URL at the @ or #. The client is sending Authorization instead of Proxy-Authorization. They are different headers and the proxy only reads the second. IP whitelisting is enabled on the account and this machine is not on the list, so credentials alone are not accepted.

Test the exact credential string with curl -x before debugging your code — it removes the client from the equation in one command. Percent-encode the password if it contains anything outside A-Z, a-z, 0-9 and -._~. For Scrapy, Selenium-with-Chrome and anything else that drops URL credentials, send Proxy-Authorization: Basic <base64> explicitly. Check whether the geo token is valid — an unknown country code makes the username unknown as a whole.

This is a credential problem, not a blocking problem. Changing IP, country or pool will not touch it — the request is being refused at the proxy, before any target sees it.