Using an IP allowlist instead of credentials

An IP allowlist (some providers call it a whitelist) lets the proxy accept connections from addresses you name, with no username or password in your client. It suits servers with a fixed public IP, and browsers that will not send proxy credentials. It is a poor fit for laptops, home lines and CI runners whose address moves.

Find the address to add

It has to be the public address your traffic leaves from, seen from the machine that will run the job. Run this there, without the proxy:

curl -4 https://api.ipify.org

Addresses starting 10., 172.16. to 172.31. or 192.168. are private and are refused. Checking from your laptop and running the job on a cloud server is the classic way to allowlist the wrong machine.

Switch one proxy to the allowlist

1. Open the proxy from its list under Proxies in the side menu.
2. On the Connection card, click Change next to Authentication.
3. Choose IP allowlist, enter the address in Allowed address, and use Add another address for more, up to the count the dialog allows.
4. Click Change authentication. From then on the proxy's username and password stop working, and only the listed addresses can connect.

To edit the list later, open IP allowlist on the proxy's page. Set your current IP fills in the address you are browsing from, Add another address adds more, and Save stores the list.

Entries are single public IPv4 addresses. To use a username and password again, click Change next to Authentication and choose Username and password.

If the dialog says "This proxy offers no other way to authenticate", or the allowlist page says "This plan authenticates by password", that proxy does not take an allowlist. Use its username and password, which work from anywhere.

Changes are rate-limited. If a change is refused soon after another, wait half an hour and try again. Addresses saved under Tools > IP allowlist are not applied to your proxies; set the allowlist on each proxy that needs it.

Why it stops working later

The allowlist knows an address, not a machine. These move it:

• Your provider hands home and office lines a new address now and then.
• A VPN sends traffic out from its own address.
• IPv6. A dual-stack machine may connect over IPv6 while you listed its IPv4 address.
• A cloud server can get a new address on restart unless you reserve a fixed one.

A router shared by many devices means every one of them is admitted. Remove addresses you no longer use.

Test it

curl -x http://HOST:PORT https://api.ipify.org

You should get the proxy's address back. If the proxy refuses you instead, check your current public IP against the list first. 407 or 403: find out who answered shows how to tell the proxy's refusal from the website's.