Short answer: configure the proxy host, port and protocol with Selenium’s Proxy object, but do not put username:password@ in a Chrome proxy URL and expect authentication to work. Chrome does not use credentials embedded in manual proxy settings. Authentication must be completed by a browser-supported flow—such as an enterprise Negotiate/NTLM setup, a carefully tested extension, or a proxy service that authenticates by IP allowlisting. Test routing and authentication separately before automating page actions.
What Selenium configures—and what it does not
Selenium controls the browser; it does not provide a proxy endpoint or validate proxy credentials. Its Python API exposes a Proxy object and browser options for routing traffic. The API reference is at Selenium Proxy API, with browser capability details in the Selenium Options API.
Proxy routing and proxy authentication are separate operations:
- Routing: tell Chrome which proxy host and port to use.
- Authentication: answer the proxy’s HTTP authentication challenge with a scheme Chrome supports.
- Verification: prove that the request actually exited through the intended proxy.
Chromium’s documentation states: “Chrome does not implement this, and will not use any credentials embedded in the proxy settings.” Therefore, http://user:password@proxy.example:8080 is not a reliable Chrome solution. See Chromium’s proxy support documentation.
#1 Best Overall
Before you write the script
Collect the exact proxy details
- Hostname or IP address and port.
- Protocol supplied by the provider: HTTP, HTTPS or SOCKS.
- Authentication scheme: Basic, Digest, Negotiate or NTLM for an HTTP proxy, if applicable.
- Username and password, or the provider’s IP-allowlist instructions.
- Any bypass or no-proxy rules.
Confirm the endpoint outside Selenium with a provider-approved client. A 407 response means the proxy requested authentication; it is not a Selenium selector or page-form error.
Keep credentials out of code
Read secrets from environment variables or a secret manager. Do not commit them, place them in shell history, print them in logs, or capture authentication dialogs in screenshots.
Pin and record your runtime
Record the Python, Selenium, Chrome and ChromeDriver versions used in CI. Headless behavior, especially extension loading, can vary between pinned Chrome releases.
Configure the proxy endpoint in Python Selenium
The following program configures an authenticated-proxy endpoint without embedding credentials, runs Chrome in headless mode, and visits a verification URL. Replace the URL with an endpoint controlled by you that reports the observed egress address.
import os
from selenium import webdriver
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.common.proxy import Proxy, ProxyType
proxy_host = os.environ["PROXY_HOST"]
proxy_port = int(os.environ["PROXY_PORT"])
verify_url = os.environ["VERIFY_URL"]
proxy = Proxy()
proxy.proxy_type = ProxyType.MANUAL
proxy.http_proxy = f"{proxy_host}:{proxy_port}"
proxy.ssl_proxy = f"{proxy_host}:{proxy_port}"
options = Options()
options.add_argument("--headless=new")
options.add_argument("--no-sandbox")
options.add_argument("--disable-dev-shm-usage")
options.proxy = proxy
# Selenium starts Chrome; the proxy challenge, if any, is a separate step.
driver = webdriver.Chrome(options=options)
try:
driver.get(verify_url)
print("title:", driver.title)
print("url:", driver.current_url)
finally:
driver.quit()Set the values before running:
export PROXY_HOST=proxy.example.com
export PROXY_PORT=8080
export VERIFY_URL=https://your-controlled-echo.example/
python proxy_check.pyUse ssl_proxy when HTTPS destinations must traverse the same endpoint. Add a bypass list only when you intentionally want some hosts to connect directly; an accidental bypass can make a test appear successful while avoiding the proxy.
How Chrome handles proxy authentication
HTTP and HTTPS proxies
Chromium documents Basic, Digest, Negotiate and NTLM authentication for HTTP proxies. Basic sends credentials without encryption at the authentication layer, so use a protected connection and follow your provider’s security requirements. Communication with an HTTPS proxy is protected by TLS according to Chromium’s proxy documentation.
SOCKS5
Chrome’s SOCKSv5 implementation supports no authentication methods. A provider may advertise SOCKS5 username/password authentication in other clients, but that does not make it available in Chrome. If credentials are mandatory, choose an HTTP or HTTPS proxy scheme that Chrome and the provider both support.
Negotiate and NTLM
Chrome can use cached machine credentials for integrated Negotiate or NTLM authentication under documented restrictions. This is an enterprise identity flow, not a general-purpose way to inject arbitrary per-proxy username and password values. See Chrome’s HTTP authentication documentation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Ways to satisfy the credential challenge
Prefer provider IP allowlisting when available
Many proxy services can authorize a fixed egress IP instead of prompting the browser for credentials. Allowlist the machine or CI runner’s public IP with the provider, then use the endpoint-only Selenium configuration above. This avoids exposing a password to browser automation and is usually the simplest headless arrangement. Confirm that the runner’s address is stable; ephemeral CI addresses often are not.
Use enterprise integrated authentication
For a corporate proxy using Negotiate or NTLM, run Chrome in the managed environment where the required machine credentials and policies are available. Validate the exact Chrome policy and account context with your administrator. A local username/password pair is not interchangeable with these cached credentials.
Use an extension only after version-specific testing
Chrome exposes the chrome.proxy extension API, which requires the proxy permission: Chrome proxy API documentation. An extension can set proxy rules and participate in an authentication challenge, but official documentation does not establish one universal recipe for every Chrome version, headless mode and Selenium configuration. Treat extension code as a version-pinned implementation, not a portable guarantee.
If you choose this route, test all of the following in the exact runtime used in production:
- Load the extension in the selected headless mode and confirm Chrome reports it as enabled.
- Verify the proxy scheme and challenge type (Basic, Digest, Negotiate or NTLM).
- Inspect ChromeDriver and browser logs for extension or authentication errors.
- Use a controlled egress endpoint and compare the observed address with a direct request.
- Remove credentials from extension source, generated archives and diagnostic artifacts.
Do not assume Selenium page code can fill a browser-level proxy prompt. A proxy challenge occurs below ordinary page DOM interaction.
Verify routing before automating the target site
- Make a direct request from the same host and record its public egress address.
- Launch the Selenium session with the proxy endpoint configured.
- Visit a controlled endpoint that reports the source address, protocol and relevant headers.
- Confirm the address differs as expected and that the endpoint did not return a 407 challenge.
- Only then visit the real target and begin element-level automation.
Never infer successful proxy use merely because Chrome launched or a page rendered. A bypass rule, cached response or direct network path can produce a normal-looking page.
Proxy scheme comparison
| Scheme | Connection to proxy | Chrome authentication notes | DNS and traffic considerations |
|---|---|---|---|
| HTTP | Plain HTTP proxy connection unless protected by the deployment | Basic, Digest, Negotiate and NTLM are documented | Proxy handles requests; confirm how the provider resolves names |
| HTTPS | TLS-protected proxy communication | Use a scheme supported by both Chrome and the provider | Suitable when the provider requires encrypted client-to-proxy transport |
| SOCKSv5 | SOCKS transport | Chrome documents no SOCKSv5 authentication methods | Do not select it for a credential-required Chrome flow without an alternative authorization method |
The provider’s advertised protocol and Chrome’s implementation must agree. Ask which side performs DNS resolution and whether the endpoint supports every traffic type your test requires.
Common failures and fixes
Chrome starts, but the site returns 407
Cause: the proxy challenged Chrome and no supported credential flow answered it, or the credentials/scheme are wrong. Fix: validate the endpoint externally, check the provider’s challenge scheme, remove any user:password@ URL, and use allowlisting, integrated authentication or a tested extension.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe browser shows a proxy authentication dialog
Cause: authentication is occurring at browser/network level, outside the page DOM. Fix: do not search for username fields with Selenium; implement the browser-supported challenge mechanism or change the provider authorization method.
Traffic reaches the destination directly
Cause: an incorrect proxy capability, a bypass rule, or a protocol mismatch. Fix: inspect the effective options, remove broad bypass rules, and verify the egress address with a controlled endpoint.
SOCKS credentials never work
Cause: Chrome does not support SOCKSv5 authentication methods. Fix: request an HTTP/HTTPS endpoint, use provider IP allowlisting, or choose a client that supports the provider’s SOCKS authentication.
An extension works headed but not headless
Cause: extension support differs by Chrome release and headless mode. Fix: pin the tested versions, confirm extension loading in that exact mode, inspect logs, and maintain a fallback such as IP allowlisting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The proxy works intermittently in CI
Cause: rotating runner IPs, exhausted proxy limits, transient provider failures or an unstable extension setup. Fix: log status and timing without secrets, use bounded retries for navigation, verify each run’s egress address, and ask the provider whether the endpoint is shared or rotating.
Reliability, performance and security practices
- Start one driver per isolated job when possible; reuse it only when session state and proxy identity may safely be shared.
- Set explicit navigation and command timeouts. A proxy adds another network hop, so distinguish connection, authentication and page-load failures in logs.
- Do not retry a failed authenticated request indefinitely. Use a small, bounded retry policy and stop on repeated 407 responses.
- Redact proxy URLs, environment dumps, exception messages and screenshots that may contain credentials or private pages.
- Use a dedicated proxy identity for tests that must be reproducible. Rotating addresses can change geolocation, rate limits and application behavior.
- Check terms, authorization and robots or access policies before automating a site through a proxy.
WebDriver BiDi is not a proxy-password shortcut
WebDriver BiDi is Selenium’s W3C bidirectional protocol for browser events and functionality. Enabling BiDi can help with supported browser events and network-related automation, but Selenium’s documentation does not establish it as a general solution for entering proxy credentials. Configure and authenticate the proxy using a mechanism appropriate to Chrome and the proxy scheme.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
If your actual requirement is a clean image or PDF of a URL rather than interactive Selenium automation, ScreenshotNeo provides a single screenshot API call. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; bot checks, blank pages, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server exposes take_screenshot, get_page_info and capture_pdf for Claude, Cursor and other MCP clients.
See the ScreenshotNeo documentation for request options and authentication. cURL:
Recommended Free Tools
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo includes full-page and element capture, device and retina settings, custom headers, cookies, user agents, JavaScript and CSS, waits, blocking rules, caching, signed links, asynchronous webhooks and bulk capture. Every feature is on every plan. The Free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
FAQ
Can I put the proxy username and password in Chrome’s proxy URL?
No. Chromium says Chrome will not use credentials embedded in manual proxy settings. Use a supported authentication flow or provider IP allowlisting.
Does Selenium provide proxy credentials?
No. Selenium configures browser capabilities; the proxy service and its authentication mechanism are separate.
Which authenticated proxy type is safest for Chrome?
There is no universal winner. Choose an HTTP or HTTPS scheme supported by both your provider and Chrome, prefer encrypted transport and stronger available authentication, and verify it in the exact headless runtime.
Frequently Asked Questions
Can I use a SOCKS5 username and password with headless Chrome?
Chrome’s documented SOCKSv5 implementation provides no authentication methods, so use an HTTP/HTTPS proxy or an alternative authorization method.
Why does a successful page load not prove the proxy worked?
A bypass rule, cache or direct network path can still load the page. Verify the public egress address with a controlled endpoint.
Is WebDriver BiDi required for authenticated proxies?
No. BiDi is a bidirectional browser protocol, not a general proxy-authentication mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
