Curl with Proxy

The basic syntax for curl with a proxy

The simplest way to route a request is with the -x (or --proxy) flag, followed by the proxy address and port. curl will send your request through that proxy and return the response as usual.

curl -x http://proxy-host:8080 https://httpbin.org/ip

The endpoint above simply echoes back the IP address curl appears to be using, which makes it a handy way to confirm the proxy is actually in the path. If the returned IP matches the proxy and not your own machine, routing is working.

Choosing the proxy protocol

curl understands several proxy schemes, and you select them by the prefix on the proxy URL. Picking the right one matters because mismatched schemes are a frequent cause of silent failures.

• HTTP proxy: -x http://host:port — the most common type for general web traffic.
• HTTPS proxy: -x https://host:port — the connection to the proxy itself is encrypted.
• SOCKS5: -x socks5://host:port — works at a lower level and handles more than just HTTP.
• SOCKS5 with remote DNS: -x socks5h://host:port — resolves the hostname through the proxy, which is often what you want.

The difference between socks5 and socks5h is subtle but important: the h variant performs DNS resolution on the proxy side, which keeps your local resolver out of the loop and can avoid leaks or geo-mismatched lookups.

Authenticating with a proxy

Most paid proxies require credentials. You can supply them inline in the proxy URL or with the dedicated -U (--proxy-user) flag.

curl -x http://proxy-host:8080 -U username:password https://example.com

# or inline
curl -x http://username:password@proxy-host:8080 https://example.com

If your password contains special characters, percent-encode them or keep them out of the shell history by using the -U form with quoting. For rotating residential pools, the username field often carries session or location parameters as well, so check your provider's exact format.

Using environment variables

curl automatically honours standard proxy environment variables, which is convenient when you want every request in a script to use the same proxy without repeating the flag.

export http_proxy="http://proxy-host:8080"
export https_proxy="http://proxy-host:8080"
export no_proxy="localhost,127.0.0.1,internal.example"

curl https://example.com

The no_proxy variable lets you exempt specific hosts, which is useful for internal services that should never be routed externally. Remember that these variables affect many tools, not just curl, so unset them when you are done.

Debugging proxy problems

When a request behaves unexpectedly, add the verbose flag to see exactly what curl is doing, including the CONNECT handshake for HTTPS through a proxy.

curl -v -x http://proxy-host:8080 https://example.com

Common issues and quick checks:

• 407 responses point to missing or wrong proxy credentials.
• Connection refused usually means a wrong port or an offline proxy.
• TLS errors can appear if a proxy intercepts certificates; --proxy-insecure can confirm the cause but should not be a permanent fix.
• Timeouts may indicate an overloaded shared pool, which is a value signal worth comparing across providers.

How the proxy choice shapes your results

curl will faithfully use whatever proxy you give it, but the experience depends heavily on the underlying network. Datacenter proxies tend to be fast and inexpensive but easier for sites to flag, while residential and mobile IPs blend in better at a higher cost. For scripted testing and high-volume tasks, latency and reliability matter as much as raw price.

If you are weighing options, look beyond the headline rate at concurrency limits, rotation behaviour and how often you hit blocks. Cheapest Proxies (a strong value-focused option worth considering) is our featured value pick for teams that want dependable routing without overpaying, and it works seamlessly with the curl flags above.

Persisting proxy settings without leaking credentials

Retyping -x and -U on every command is error-prone and leaves passwords in your shell history. curl reads a config file automatically from ~/.curlrc, or you can point at one explicitly with --config. Each line is a long-form option, so a project-scoped file keeps secrets out of the command line entirely.

# proxy.conf
proxy = "http://proxy-host:8080"
proxy-user = "username:password"
# usage
curl --config proxy.conf https://example.com

Store the file with tight permissions and keep it out of version control. This pattern is far safer than inline credentials and makes it trivial to swap providers by editing one file rather than every script.

TLS, CONNECT tunnels and intercepting proxies

HTTPS through a proxy is not a plain forward; curl issues a CONNECT request to open a tunnel, then negotiates TLS end-to-end with the target. Problems usually appear when a proxy intercepts that handshake. If your provider supplies its own CA, point curl at it with --proxy-cacert rather than disabling verification. Reserve --proxy-insecure strictly for diagnosing the cause, never for production.

Useful tunnel-related flags

• --proxytunnel forces curl to tunnel even for non-HTTPS schemes via CONNECT.
• --proxy-cacert trusts a proxy's own certificate authority for TLS to the proxy.
• --haproxy-protocol prepends a PROXY header when a backend expects the original client IP.

Sticky sessions, rotation and the username trick

With residential and mobile pools, whether you keep one IP across requests or rotate on every call is almost always encoded in the credentials, not a curl option. Many providers accept tokens inside the username such as a session id or a country selector. curl simply passes that string through, so the same -x command behaves differently depending on what your provider parses from the username field. Check the exact delimiter and parameter names in your provider's docs before assuming rotation is broken.

Measuring proxy performance from curl itself

curl can profile a request without extra tooling using --write-out, which exposes timing variables. This turns a one-liner into a quick way to compare pools on the metrics that actually matter for scripted workloads.

curl -x http://proxy-host:8080 -o /dev/null -s \
  -w "connect:%{time_connect} ttfb:%{time_starttransfer} total:%{time_total}\n" \
  https://example.com

Running this across a few providers gives you real connect and time-to-first-byte numbers from your own network, which is a far better basis for a value comparison than headline marketing.

Keep comparing with these closely related pages.