How to Use a Proxy with cURL

The quickest way to send a request through a proxy in cURL is the -x flag (long form --proxy):

curl -x http://USER:PASS@GATEWAY:PORT https://api.ipify.org

api.ipify.org echoes the exit IP — if the output matches your proxy's IP instead of your own, the tunnel works.

Proxy URL syntax

cURL accepts a full URL as the proxy value. The scheme decides the protocol used between you and the proxy:

http://user:pass@host:port      # HTTP proxy (most common)
https://user:pass@host:port     # proxy itself reached over TLS
socks5://user:pass@host:port    # SOCKS5, hostname resolved by proxy
socks5h://user:pass@host:port   # SOCKS5, hostname resolved AT proxy

HTTPS targets through an HTTP proxy

For https:// URLs cURL issues an HTTP CONNECT request to the proxy, then upgrades the tunnel to TLS. The proxy never sees the plaintext — that is why plain HTTP proxies are fine for HTTPS targets:

curl -x http://USER:PASS@GATEWAY:PORT https://target-site.com -I

If you get 407 Proxy Authentication Required, the credentials are wrong or missing; if you get CONNECT tunnel failed, the proxy does not allow that host or port.

Environment variables

cURL (and most Unix tools) honor lowercase environment variables. Set them once per shell:

export http_proxy="http://USER:PASS@GATEWAY:PORT"
export https_proxy="http://USER:PASS@GATEWAY:PORT"
export all_proxy="socks5h://USER:PASS@GATEWAY:PORT"
export no_proxy="localhost,127.0.0.1,.internal.example.com"

no_proxy excludes hosts that must bypass the tunnel — always include your own infrastructure and health-check endpoints.

Per-project config with .curlrc

Environment variables leak between projects. A scoped config file does not:

# ~/projects/shop-monitor/.curlrc
proxy = "http://USER:PASS@GATEWAY:PORT"
noproxy = "localhost,127.0.0.1"

curl -K ~/projects/shop-monitor/.curlrc https://target-site.com

Verifying what the target sees

Exit IP is only half of the story. Also check the geo and ASN the target infers:

curl -x http://USER:PASS@GATEWAY:PORT https://api.ipify.org
curl -x http://USER:PASS@GATEWAY:PORT "https://ipinfo.io/json" | head -20

Rotation

With a rotating gateway you do not rotate in cURL — the provider rotates exit IPs for you. To pin a session (same IP across several requests), most providers accept a session token in the username; with cURL you simply reuse the same credentials:

for i in 1 2 3; do
  curl -s -x http://USER-SESSION-abc123:PASS@GATEWAY:PORT https://api.ipify.org; echo
done

Common errors cheat sheet

FAQ

Does -x work for HTTPS URLs?

Yes. For https:// targets cURL opens an HTTP CONNECT tunnel through the proxy and upgrades it to TLS, so the proxy never sees plaintext. A plain http:// proxy entry is sufficient for HTTPS targets.

socks5 vs socks5h in curl?

socks5 resolves DNS locally; socks5h resolves DNS on the proxy side. For scraping use socks5h to avoid DNS leaks and geo-mismatched CDN routes.

How do I rotate IPs in curl?

You don't — a rotating gateway rotates exit IPs server-side. To pin one IP across requests, include a session token in the proxy username and reuse the same credentials.

Why 407 Proxy Authentication Required?

The proxy rejected your credentials. Check the user:pass portion of the proxy URL and URL-encode special characters, e.g. @ becomes %40.

Ready to test against a real pool? IPLight's rotating residential proxies start at $1.20/GB (down to $0.72/GB at volume) across 170+ countries — see pricing or the live pool report.