# Proxy-Authorization header

The HTTP **`Proxy-Authorization`** [request header](https://developer.mozilla.org/en-US/docs/Glossary/request%20header) contains the credentials to authenticate a client with a proxy server, typically after the server has responded with a [407 Proxy Authentication Required](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/407) status with the [Proxy-Authenticate](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authenticate) header.

<table class="properties">
  <tbody>
    <tr>
      <th scope="row">Header type</th>
      <td>[Request header](https://developer.mozilla.org/en-US/docs/Glossary/Request%20header)</td>
    </tr>
    <tr>
      <th scope="row">[Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header)</th>
      <td>Yes</td>
    </tr>
  </tbody>
</table>

## Syntax

```http
Proxy-Authorization: <auth-scheme> <credentials>
```

## Directives

- `<auth-scheme>`
  - : A case-insensitive token indicating the [Authentication scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#authentication_schemes) used.
    Some of the more common types are [`Basic`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#basic_authentication_scheme), `Digest`, `Negotiate` and `AWS4-HMAC-SHA256`.
    IANA maintains a [list of authentication schemes](https://www.iana.org/assignments/http-authschemes), but there are other schemes offered by host services.
- `<credentials>`
  - : Credentials use for the authentication scheme.
    Generally, you will need to check the relevant specifications for the format.

> **NOTE:**
> See [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) for more details.

## Examples

### Basic authentication

In `Basic` auth, credentials are sent in the format `<username>:<password>` (for example, `aladdin:opensesame`).
The resulting string is then [base64](https://developer.mozilla.org/en-US/docs/Glossary/Base64) encoded (`YWxhZGRpbjpvcGVuc2VzYW1l`).

```http
Proxy-Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
```

> **WARNING:**
> Base64 encoding is reversible, and therefore offers no cryptographic security.
> This method can be considered equivalent to sending the credentials in clear text.
> [HTTPS](https://developer.mozilla.org/en-US/docs/Glossary/HTTPS) is always recommended when using authentication, but is even more so when using `Basic` authentication.

### Bearer authentication (auth token)

```http
Proxy-Authorization: Bearer kNTktNTA1My00YzLT1234
```

## Specifications

## See also

- [HTTP authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication)
- [Proxy-Authenticate](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authenticate)
- [WWW-Authenticate](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/WWW-Authenticate)
- [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization)
- [401](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401), [403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403), [407](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/407)