FoxyProxy Setup With Username and Password

People describe both problems as "FoxyProxy isn't working," but they come from different places and need different fixes.

Symptom A: the login box. In Chrome it is a dialog titled "Sign in" with the line "The proxy [address] requires a username and password." Firefox shows its own authentication prompt naming the proxy. This box means the browser received a 407 Proxy Authentication Required from the proxy and nobody answered it: FoxyProxy had no credentials stored for that exact proxy, so the browser fell back to asking you.

Symptom B: the dead tab. The page spins, then Chrome shows an error code such as ERR_PROXY_CONNECTION_FAILED, ERR_TUNNEL_CONNECTION_FAILED or ERR_SOCKS_CONNECTION_FAILED. No dialog appears. Here the connection broke before or during the proxy handshake, or the extension answered with credentials the proxy rejected.

Keep that split in mind. A popup is nearly always a configuration mismatch inside the browser. A dead tab can be the browser, the network, or the account. The rest of this post fixes each in order.

If you have not yet set a proxy in a browser at all, the native settings dialogs and the Chrome launch flag are covered in our guide to configuring a proxy in Chrome and Firefox. This post assumes you want the extension route because you only want some sites proxied.

Versions read for this guide: FoxyProxy 9.8 on GitHub and Firefox Add-ons (both dated 14 September 2026), and 9.7 on the Chrome Web Store (listed as updated 8 September 2026, "600,000 users"). The project is GPL-2.0 at github.com/foxyproxy/browser-extension, had 537 stars and a last commit on its main branch of 14 September 2026 when we checked on 30 October 2026, and its 9.8 manifest sets a minimum of Chrome 126 and Firefox 128. Since version 8 the same code base serves Chrome and Firefox and both the Standard and Basic editions.

The extension's help page lists a fixed proxying order. A request is tested against each stage and the first one that claims it wins:

Within Proxy by Patterns, FoxyProxy walks your active proxies from top to bottom. For each one it checks the exclude patterns first; a hit skips that proxy. Then it checks include patterns; a hit uses that proxy. If no proxy claims the URL, the connection goes direct.

How that happens differs by browser, and the difference explains several "it works in Firefox but not Chrome" reports. On Chrome, FoxyProxy's source (src/content/proxy.js) turns your patterns into a PAC script and installs it through chrome.proxy.settings with mandatory: true. Chrome's API reference defines that flag this way: "If true, an invalid PAC script will prevent the network stack from falling back to direct connections." Abridged, the generated function looks like this:

// Abridged from FoxyProxy 9.8 Chrome.getPacString(): your patterns become regexes
function FindProxyForURL(url, host) {
  const match = array => array.some(i => new RegExp(i, 'i').test(url));
  if (match(passthrough) || inNet()) { return 'DIRECT'; }
  for (const proxy of data) {            // active proxies, top to bottom
    if (!match(proxy.exclude) && match(proxy.include)) { return proxy.str; }
  }
  return 'DIRECT';                        // nothing matched
}

So everything that is true of PAC files in Chrome is true of FoxyProxy patterns in Chrome. The two PAC rules that matter here are covered below; the general syntax is in our explainer on what a PAC file is.

One more rule from the same file trips people up: if you choose Proxy by Patterns but no proxy has a single include, exclude or tab pattern, FoxyProxy quietly switches to sending everything through the first proxy in the list. "I picked patterns and now every site is proxied" usually means the patterns were never saved.

Open the FoxyProxy options page, go to the Proxies tab and click Add. For a SparkProxy line delivered as gateway.sparkproxy.io:11000:sp-user-12345:A1b2c3d4e5, fill the fields like this:

Click Save. Editing in FoxyProxy is non-destructive, so nothing applies until you do.

The detail that decides whether the popup ever appears sits in src/content/authentication.js. FoxyProxy builds its credential table with this rule:

// FoxyProxy 9.8, Authentication.init()
hostname && port && username && password &&
  (this.data[`${hostname}:${port}`] = {username, password});

Read it literally. A credential is stored only when all four fields are non-empty, and it is filed under the string hostname:port. When the proxy challenges the browser, the listener looks up the challenger's host and port in that table. Three consequences follow:

1. Leave the password blank (to "type it later") and nothing is stored. The browser's own prompt takes over.
2. Credentials are per port. A second entry for gateway.sparkproxy.io:11002 without its own username and password gets the popup, even though the 11000 entry works. FoxyProxy's help states it directly: "Username and Password are port specific."
3. The listener ignores challenges from websites. It only answers when isProxy is true, so a site's own HTTP login prompt is untouched.

If your SparkProxy account uses IP whitelisting instead, leave both credential fields empty. The proxy never sends a 407 to a whitelisted address, so there is nothing to answer. The trade-offs between the two methods are explained in what IP whitelisting is for proxies.

FoxyProxy offers three pattern types: Wildcard, Match (added in 9.0) and Reg Exp. All of them end up as case-insensitive regular expressions tested against the URL. Wildcard is the default and the one that surprises people, because it is a substring search, not a host comparison.

Here is the wildcard conversion from src/content/pattern.js, ported to Python so you can test patterns before saving them. The second function applies Chrome's PAC rule, which the Chromium network docs describe as stripping "the path, query, fragment, and identity portions" of https:// URLs (a change made in Chrome 52):

import re
from urllib.parse import urlsplit

SPECIAL = set(".+^${}()|[]\\")


def foxy_wildcard(pattern: str) -> str:
    """Mirror of FoxyProxy 9.8 Pattern.convertWildcard (src/content/pattern.js)."""
    if pattern == "*":
        return r"\w+"
    escaped = "".join("\\" + ch if ch in SPECIAL else ch for ch in pattern)
    escaped = re.sub(r"^\*|\*$", "", escaped)
    return escaped.replace("*", ".*").replace("?", ".")


def chrome_pac_url(url: str) -> str:
    """Chrome 52+ strips path, query and fragment from https:// URLs passed to PAC."""
    parts = urlsplit(url)
    return f"{parts.scheme}://{parts.netloc}/" if parts.scheme == "https" else url


def matches(pattern: str, url: str) -> bool:
    # FoxyProxy runs new RegExp(rx, 'i').test(url): a search anywhere, not a full match
    return re.search(foxy_wildcard(pattern), url, re.IGNORECASE) is not None


tests = [
    ("sparkproxy.io", "https://docs.sparkproxy.io/"),
    ("sparkproxy.io", "http://203.0.113.10/?ref=sparkproxy.io"),
    ("://*.sparkproxy.io/", "https://www.sparkproxy.io/"),
    ("://*.sparkproxy.io/", "https://www.sparkproxy.io/"),
    ("https://www.sparkproxy.io/blog/*", "https://www.sparkproxy.io/blog/what-is-a-pac-file"),
]
print(f"{'pattern':29} {'url':47} firefox chrome")
for pat, url in tests:
    print(f"{pat:29} {url:47} {matches(pat, url)!s:7} {matches(pat, chrome_pac_url(url))}")

We ran it on Python 3.14.2. Output:

pattern                       url                                             firefox chrome
sparkproxy.io                 https://docs.sparkproxy.io/                     True    True
sparkproxy.io                 http://203.0.113.10/?ref=sparkproxy.io          True    True
://*.sparkproxy.io/           https://www.sparkproxy.io/                          False   False
://*.sparkproxy.io/           https://www.sparkproxy.io/                      True    True
https://www.sparkproxy.io/blog/*  https://www.sparkproxy.io/blog/what-is-a-pac-file   True    False

Three lessons sit in those five rows.

• A bare domain matches anywhere in the URL. sparkproxy.io caught an unrelated address because the string appeared in its query. FoxyProxy's own pattern guide shows the same thing with example.com matching https://google.com/ref=help.example.com.
• . does not include the apex. ://.sparkproxy.io/ matched www but not the bare domain. Add a second pattern for the apex, or use the Match type ://.sparkproxy.io/*, which FoxyProxy documents as matching "the domains and its subdomains."
• Path patterns are Firefox-only for HTTPS. Chrome never shows the matcher /blog/... on an HTTPS page, so a path pattern silently fails and the site loads direct.

A pattern set that behaves the same in both browsers for one site and its subdomains:

Type: Match     Include   *://*.sparkproxy.io/*
Type: Wildcard  Exclude   ://status.sparkproxy.io/

Two shortcuts help while you browse. Include Host and Exclude Host in the toolbar menu (and the right-click menu) add the current page's host to the selected proxy, and the options page has a Pattern Tester that runs a URL against your saved rules. Remember that a page pulls assets from other hosts: if a site's CDN or API domain is not covered, those requests go direct, which can trigger a region mismatch even though the main document came through the proxy.

This one is not a FoxyProxy bug, and no setting inside the extension changes it. Chromium's own network documentation says: "No authentication methods are supported for SOCKSv5 in Chrome (although some do exist for the protocol)." FoxyProxy repeats it in the credential field help: "SOCKS5 username and password is only supported by Firefox (not available on Chrome)."

You can see why in Chromium's net/socket/socks5_client_socket.cc. Chrome's opening greeting is three fixed bytes, 0x05 0x01 0x00: SOCKS version 5, one method offered, and that method is "no authentication." If the server picks anything other than 0x00, Chrome aborts with ERR_SOCKS_CONNECTION_FAILED. It never offers the username/password method (0x02) at all, so the username and password you typed have no place to go.

We checked what SparkProxy's SOCKS5 port does with each greeting, from a build server that is not on any whitelist (30 October 2026):

import socket
import struct

HOST, PORT = "gateway.sparkproxy.io", 13000

for greet, label in ((b"\x05\x01\x00", "no-auth only (Chrome)"),
                     (b"\x05\x02\x00\x02", "no-auth + user/pass (Firefox, curl)")):
    with socket.create_connection((HOST, PORT), timeout=10) as s:
        s.sendall(greet)
        print(label, "-> method", s.recv(2).hex())

# Continue Chrome's path: ask for a tunnel to sparkproxy.io:443
with socket.create_connection((HOST, PORT), timeout=10) as s:
    s.sendall(b"\x05\x01\x00")
    s.recv(2)
    name = b"sparkproxy.io"
    s.sendall(b"\x05\x01\x00\x03" + bytes([len(name)]) + name + struct.pack(">H", 443))
    print("CONNECT reply", s.recv(10).hex())

no-auth only (Chrome) -> method 0500
no-auth + user/pass (Firefox, curl) -> method 0502
CONNECT reply 05020001000000000000

The gateway accepts Chrome's no-auth greeting, then refuses the tunnel with reply code 0x02, which RFC 1928 defines as "connection not allowed by ruleset." Offered the password method, it picks 0x02 and waits for credentials. Our reading: on this port, a client that cannot send a password is admitted only if its IP is whitelisted. We could not test the whitelisted case from our build server, so treat that last step as inferred from the replies, not observed.

That leaves Chrome users two working setups and Firefox users three:

For an HTTP proxy, name resolution already happens at the proxy side in both browsers per FoxyProxy's DNS table, so choosing HTTP over SOCKS5 costs nothing in DNS privacy. The protocol differences are laid out in HTTP, HTTPS and SOCKS5 proxy protocols.

Work down this list. Each check takes less effort than the one after it.

1. Is FoxyProxy actually in control? On Chrome, only one extension sets proxy settings at a time. When another proxy or VPN extension holds them, FoxyProxy's source greys the toolbar icon and changes its tooltip to "Settings are controlled by other extensions." In that state FoxyProxy does nothing at all, including answering logins. Disable the other extension, then re-select your mode in FoxyProxy.

2. Are all four fields filled on the entry that is being used? Open the entry and confirm hostname, port, username and password. A blank password means no stored credential.

3. Does the host:port in the popup match the entry exactly? The popup names the proxy that challenged. If it says port 11002 and only your 11000 entry has credentials, that is the whole bug. Duplicate the working entry, change the port, and keep the login fields.

4. Are you in an Incognito or private window? FoxyProxy's help states that Chrome users "must enable 'Allow in Incognito'" to proxy incognito windows, and that Firefox requires "Run in Private Windows" for proxy settings. Chrome does not run an extension in incognito without that toggle, so nothing is there to answer the challenge. Turn it on at chrome://extensions, under FoxyProxy's Details.

5. Did the popup appear while using FoxyProxy's Test button on Chrome? The help notes: "On Chrome, proxy authentication must be done before starting the test." Chromium does not fire onAuthRequired for requests made from extension pages (Chromium issue 40880379), so load any proxied page first, then run the test.

One case where the popup cannot appear: wrong credentials stored in FoxyProxy. Its listener records each request it has answered, and if the proxy challenges the same request a second time it returns {cancel: true} ("prevent bad authentication loop," says the comment). So a typo in the password produces a dead tab, not a repeating box. Which brings us to the second symptom.

Cheapest check first. Each line says whether a proxy change can help at all.

Chromium's error list defines ERR_PROXY_CONNECTION_FAILED as a failure to resolve or connect to the proxy and says it "does NOT include failures during the actual 'CONNECT' method of an HTTP proxy." That distinction is the useful one: PROXY_CONNECTION_FAILED is a network problem, TUNNEL_CONNECTION_FAILED is usually an account problem.

Two non-error causes are worth ruling out early. If FoxyProxy's mode is Proxy by Patterns and the site is not matched, the tab is going direct, so a dead tab there is not a proxy fault. And on Chrome, because patterns run as a mandatory PAC script, an invalid script does not fall back to direct. If every site died right after you edited patterns, disable the newest one and test again.

Before you blame the extension, check the credentials with a tool that has no extensions, no saved passwords and no patterns. This is what a rejected login looks like from curl 8.15.0 against the SparkProxy gateway, run on 30 October 2026 from a machine that is not whitelisted:

curl -sv -x http://gateway.sparkproxy.io:11000 http://www.sparkproxy.io/ -o /dev/null 2>&1 | grep "^< "
# < HTTP/1.1 407 Proxy Authentication Required
# < Proxy-Authenticate: Basic realm="SparkProxy"

curl -sS -x http://sp-user-12345:A1b2c3d4e5@gateway.sparkproxy.io:11000 https://www.sparkproxy.io/ -o /dev/null
# curl: (56) CONNECT tunnel failed, response 407

The first header pair tells you what the browser receives: a Basic challenge with the realm "SparkProxy." The second line is the exact error for wrong credentials or an unlisted IP over HTTPS. With correct credentials the second command exits quietly.

The same test in Python, checking both the rotating and the Sticky Sessions port so you catch the per-port mistake from earlier:

import sys

import requests

HOST = "gateway.sparkproxy.io"
USER = "sp-user-12345"      # paste exactly what you typed into FoxyProxy
PASS = "A1b2c3d4e5"

for port in (11000, 11002):
    proxy = f"http://{USER}:{PASS}@{HOST}:{port}"
    try:
        r = requests.get("https://www.sparkproxy.io/", proxies={"http": proxy, "https": proxy}, timeout=20)
        print(port, "OK", r.status_code)
    except requests.exceptions.ProxyError as exc:
        # A 407 on the CONNECT tunnel lands here: wrong user/pass, or IP not whitelisted
        print(port, "REJECTED (407)" if "407" in str(exc) else f"PROXY ERROR {exc}")
    except requests.exceptions.ConnectTimeout:
        print(port, "TIMEOUT: host or port unreachable from this network")
        sys.exit(1)

On our non-whitelisted server with placeholder credentials, requests 2.32.5 raised Tunnel connection failed: 407 Proxy Authentication Required for both ports, and the script printed REJECTED (407) twice. If this script succeeds and the browser still fails, the problem is in the browser configuration, and the popup checklist above applies. If the script fails too, fix the account first; no extension setting will help. A broader checklist lives in how to test if your proxy is working.

The port you pick in FoxyProxy decides how often your exit IP changes, and for interactive browsing that matters more than people expect.

A browser opens several parallel connections per page. On a rotating port those connections can leave through different IPs, so one page view can look like several visitors to the target. That is fine for reading a public page and a common reason for "logged out after one click" on a site with session checks. Use the Sticky Sessions port for anything you sign into. Background on how sticky sessions hold an IP is in what a sticky session proxy is.

Cost works differently from per-GB proxies. SparkProxy plans are packs starting from $75/month (USD, as listed on sparkproxy.io in October 2026) with unlimited bandwidth included, so heavy pages or video in a proxied tab do not add charges. The plan's concurrency is the limit to watch, and a browser that opens many connections uses more of it than a script making one request at a time. Plans include IP whitelist and user:pass authentication, HTTP/HTTPS/SOCKS5, 1M+ premium IPs across 80+ countries, and a 24-hour free trial with no credit card, which is enough time to run the whole checklist above.

FoxyProxy routes requests. It does not change what the browser reveals, and some failures are outside any proxy's reach.

• WebRTC. WebRTC can expose your real address over a path that ignores HTTP proxy settings. FoxyProxy 9.8 has a "Limit WebRTC" option and, on Firefox only, a WebRTC toggle; both need the optional "privacy" permission. The mechanism and tests are in what WebRTC leaks are.
• Fingerprints and cookies. A new IP with the same browser profile, cookies and fingerprint is still recognisably you. A proxy cannot fix a ban tied to your account or device.
• Service workers on Firefox Tab Proxy. The help notes that service worker requests "bypass Tab Proxy due to tabId -1," so a site's service worker follows your normal proxy rules, not the tab's proxy.
• Automation. If you find yourself refreshing a proxied tab on a schedule to collect data, the browser is the wrong tool. The SparkProxy Scraping API does the fetch server-side. A plain fetch with render_js=false costs 1 credit (render_js defaults to true at 5 credits), and json_response=true wraps the result in an envelope whose body is base64:

import base64

import requests

resp = requests.get(
    "https://scrape.sparkproxy.io/api/v1",
    params={"url": "https://www.sparkproxy.io/pricing", "render_js": "false", "json_response": "true"},
    headers={"X-API-Key": "YOUR_API_KEY"},
    timeout=60,
)
envelope = resp.json()
html = base64.b64decode(envelope["body"]).decode("utf-8", "replace")
print(envelope["status_code"], envelope["credits_used"], len(html))

New accounts get 1,000 free credits. Decode body before searching it for any marker; the raw envelope is not HTML.