Setting Up an Authenticated Proxy on a Mac
Updated:
A macOS proxy setup needs two switches, not one: Web Proxy (HTTP) and Secure Web Proxy (HTTPS), both under System Settings → Network → Proxies. macOS has real username and password fields there and keeps the password in your Keychain, so Safari and Chrome connect without pop-ups. Terminal is the exception, and it gets its own section below.
System Settings > Wi-Fi > Details > Proxies > Web Proxy (HTTP) & Secure Web Proxy (HTTPS)Which proxy switches matter
The Proxies tab lists several protocols for each network service (Wi-Fi, Ethernet). For a paid ProxyV4 proxy you only use the first two.
| Switch in Proxies tab | Traffic it carries | Use with paid proxies | Login fields |
|---|---|---|---|
| Web Proxy (HTTP) | Plain HTTP | Yes, private IPv4 and static ISP | Yes |
| Secure Web Proxy (HTTPS) | HTTPS via CONNECT | Yes, private IPv4 and static ISP | Yes |
| SOCKS Proxy | SOCKS streams | No, paid proxies are HTTP(S); only some free-list entries use it | Yes |
| Bypass proxy settings for these hosts | Addresses that go direct | Add *.local, 169.254/16, 127.0.0.1 | Not applicable |
Why HTTP alone is not enough
macOS treats plain and encrypted web traffic as separate settings. If only Web Proxy (HTTP) is on, every HTTPS site, which means almost every site, still sees your own IP. Enter the identical server, port, username and password in both switches.
Doing it from Terminal with networksetup
The built-in networksetup tool sets the same values as System Settings, which is handy for scripts or for flipping a proxy on and off quickly. Replace "Wi-Fi" with your service name if you use Ethernet.
bash
# Turn on HTTP and HTTPS proxy with login for Wi-Fi
networksetup -setwebproxy "Wi-Fi" IP PORT on USER PASS
networksetup -setsecurewebproxy "Wi-Fi" IP PORT on USER PASS
# Turn both off again
networksetup -setwebproxystate "Wi-Fi" off
networksetup -setsecurewebproxystate "Wi-Fi" off
Terminal apps ignore System Settings
Safari, Chrome, Brave and Apple's own apps follow the system proxy. Command-line tools such as curl, brew, git and python do not; they read HTTP_PROXY and HTTPS_PROXY from your shell. Add exports to ~/.zshrc if you want them proxied too. The curl guide shows the format and a one-line test.
Switching quickly with Network Locations
A Location is a saved set of network settings. Create one called Proxy and keep Automatic as your direct profile: in System Settings → Network, open the '...' menu under the service list, choose Locations → Edit Locations, add the new Location, then configure the proxy while it is selected. Changing Location afterwards takes two clicks.
For per-application control instead, Proxifier chooses which Mac apps use the proxy.
Verify, then fix
Open My IP in Safari and check the address, country and network owner. Compare with the order in your dashboard.
- Own IP on most sites: Secure Web Proxy (HTTPS) is off.
- Repeated Keychain dialogs for configd or Safari: choose 'Always Allow' so background services can use the stored password.
- Sign-in failures: the password field has a typo; see 407 Proxy Authentication Required.
- IP does not change after editing: you edited a different network service or Location; see proxy IP not changing.
Step by step
- 1
Open the network service details
Choose Apple menu → System Settings → Network, select the active Wi-Fi or Ethernet service and click 'Details...'.
- 2
Turn on Web Proxy (HTTP)
Open the 'Proxies' tab, switch on 'Web Proxy (HTTP)', enter the proxy IP in 'Server' and the port in 'Port', tick 'Proxy server requires password' and fill in the username and password.
- 3
Repeat for Secure Web Proxy (HTTPS)
Switch on 'Secure Web Proxy (HTTPS)' and enter the same server, port, username and password.
- 4
Set the bypass list and apply
Make sure the bypass list holds *.local, 169.254/16 and 127.0.0.1, click OK, then check your IP in Safari or Chrome.
Frequently asked questions
Why do HTTPS sites still show my real IP on macOS?
Only Web Proxy (HTTP) is enabled. Turn on Secure Web Proxy (HTTPS) with the same details.
Why does macOS ask whether configd may use the Keychain?
The proxy password is stored encrypted in the login Keychain. Click 'Always Allow' so network services can read it without asking again.
Do brew, git or curl use the System Settings proxy?
No. Command-line tools read HTTP_PROXY and HTTPS_PROXY from the shell profile, usually ~/.zshrc.
How do I remove the proxy from my Mac?
Switch both proxy toggles off in the Proxies tab, or run the two networksetup ... off commands above. The turn-off guide covers other systems too.
Private HTTP(S) proxies for your Mac
Delivered as one ip:port:user:pass line, ready for System Settings, networksetup or Terminal. Buy a single IP or a batch.
See live prices