Proxy Authentication

Proxy authentication is how a provider decides that a connection belongs to a paying customer. Every vendor ships two mechanisms. IP whitelisting allows traffic from egress addresses you register in advance and needs no credentials at all. Username and password credentials travel in the Proxy-Authorization header or, more commonly in scraping stacks, inside the connection string as http://user:pass@gateway:port. Most accounts can use either, and many teams end up using both in different environments.

The credential path carries more than identity. Vendors have converged on packing request parameters into the username field, so the user string ends up encoding country, city, session identifier and session duration alongside the account name. It is an unofficial convention rather than a standard, but it is close to universal because a backconnect gateway has nowhere else to put per request options. It also makes credentials unusually leak prone. Those strings end up in shell history, in Dockerfiles and image layers, in CI logs, in error messages that print the failing URL, and in screenshots pasted into issue trackers. A leaked proxy credential is not an account takeover in the usual sense; it is someone else spending your bandwidth balance.

Sub-user accounts are the mechanism that limits the damage. A sub-user is a separate credential pair under the same account, typically with its own bandwidth quota, and it gives you both a blast radius and an attribution trail. One per service, or one per team, means a leak costs that sub-user's quota rather than the whole balance, and monthly spend can be split across the jobs that caused it instead of arriving as one number.

Structure the accounts before you need them. Issue a sub-user per deployed service, cap each one's bandwidth below what a runaway loop could burn overnight, rotate on a schedule and immediately on any suspected exposure, and keep the strings in a secret manager rather than in environment files baked into images. Whitelisting is the safer mechanism where it fits, since there is no credential to leak, but it breaks the moment you autoscale onto ephemeral addresses. If you want to keep it, route scraper egress through a NAT gateway or another fixed egress IP so the address the vendor sees stays constant while the workers underneath it come and go.