Use an authenticated proxy with Python Requests

Prepare an isolated client

Install Requests in a virtual environment and record the Python and Requests versions with your test. Supply real connection values through your environment or deployment secret manager. Do not commit a credential-bearing proxy URL.

The example uses an HTTP gateway for an HTTPS destination. Confirm your allocation’s supported transport and port. This guide covers Requests proxy configuration; it does not imply that MiProxy has a public management API.

Encode credentials and set a timeout

Percent-encoding each credential component prevents special characters such as @ from changing the structure of the proxy URL. Keep the original values in your environment and encode them once.

This explicit configuration disables inherited environment settings with trust_env=False. That also disables environment-based CA bundle configuration; organizations that require a custom trust bundle should set session.verify to the approved bundle path.

import os
from urllib.parse import quote
import requests

username = quote(os.environ["PROXY_USERNAME"], safe="")
password = quote(os.environ["PROXY_PASSWORD"], safe="")
proxy_url = f"http://{username}:{password}@gateway.invalid:8080"

with requests.Session() as session:
    session.trust_env = False
    session.proxies = {"http": proxy_url, "https": proxy_url}
    response = session.get(
        "https://check.invalid/ip",
        timeout=(10, 30),
    )
    response.raise_for_status()
    print(response.text)

Interpret the result carefully

Replace both .invalid hosts before using the template. The timeout tuple limits connection establishment and read inactivity; it is not a guaranteed total runtime for a batch. Start with one request and inspect the expected response body.

A Requests Session reuses connections and cookies. Provider-side sticky routing is a separate setting. For an independent task, choose that boundary deliberately rather than assuming a new Python object always produces a new residential exit.

Read the proxy dictionary from the destination outward

The http and https keys describe destination URL schemes. They do not by themselves state that the proxy gateway accepts encrypted transport. In the example, both schemes use the same documented HTTP gateway URL. Change that only when your allocation supports a different gateway transport.

Encode components, then construct the URL

A username or password can contain characters with special meaning in a URL. Percent-encode each credential component before inserting it into the gateway URL, as the example does. Encoding the entire completed URL would also transform its separators; encoding a previously encoded password can change the intended value.

Know what the timeout tuple promises

The timeout tuple separates connection establishment from read inactivity. It does not create a guaranteed wall-clock deadline for an entire batch, and a successful response still needs content validation. Build the surrounding job with its own task boundary and completion rule.

Classify a failure before adding recovery

If the proxy reports HTTP 407, examine proxy authentication and the supported method. A connection timeout, DNS failure or certificate error belongs to a different layer. If the destination returns an error after the tunnel is established, inspect that response and the destination’s access requirements separately.

Handle failures without exposing secrets

Treat proxy authentication, TLS errors and destination HTTP errors separately. An HTTPS tunnel authentication failure can surface as ProxyError rather than an ordinary response object. A timeout alone does not tell you the exit was blocked.

Catch requests.exceptions.RequestException at your application boundary and log a sanitized error category. Avoid printing the proxy URL or raw exception into shared logs because connection diagnostics can expose credentials. Stop or back off on access and rate-limit errors rather than adding unlimited retries.