Google Chrome Proxy Settings: System, Flags and Policy

On Windows, macOS and Linux, Google Chrome has no proxy form of its own. Chromium's network-settings design document explains that the network stack uses the system network settings, so the proxy row on chrome://settings/system opens the operating system's proxy settings. If an extension or your organization controls the proxy, that row says so instead.

Chromium's proxy documentation lists four origins for the active configuration: managed policy, command-line switches, a per-profile extension and the system settings. The ProxySettings policy makes Chrome ignore proxy-related switches, and Chrome's Linux manual page says --proxy-server overrides environment variables and dialog settings. On Linux, Chrome follows GNOME or KDE proxy settings under those desktops and otherwise reads http_proxy, https_proxy, all_proxy, no_proxy and auto_proxy.

That leaves three paths for a Databay route: system settings, which move every application that follows them; a separate Chrome instance launched with switches; and policy for a managed fleet. Use each only for destinations you own or are permitted to test, and follow the destination's terms.

Every Chrome control takes host gw.databay.co and port 8888, and none has a working credential field: Chromium states that Chrome will not use credentials embedded in proxy settings and relies on its sign-in prompt instead. Copy the complete username for your product and target from the Databay dashboard.

http:// describes only the Chrome-to-gateway hop; HTTPS destinations keep end-to-end TLS inside a CONNECT tunnel. Chrome's https:// proxy scheme is not part of the published gateway configuration.

For a scoped test, start a second Chrome instance with its own user data directory. Chrome's manual page says separate instances must use separate user data directories and that repeated invocations reuse an existing process for a given directory. Relaunching your open everyday profile with --proxy-server therefore hands the request to the running process, and the switch never applies. Chromium's command-line switch guide otherwise tells you to quit every running instance first.

# Windows PowerShell (adjust the path for a per-user install)
& "$env:ProgramFiles\Google\Chrome\Application\chrome.exe" `
  --user-data-dir="$env:LOCALAPPDATA\databay-chrome-us" `
  --proxy-server="http://gw.databay.co:8888" `
  https://databay.com/what-is-my-ip

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --user-data-dir="$HOME/Library/Application Support/databay-chrome-us" \
  --proxy-server="http://gw.databay.co:8888" \
  https://databay.com/what-is-my-ip

# Linux
google-chrome \
  --user-data-dir="$HOME/.config/databay-chrome-us" \
  --proxy-server="http://gw.databay.co:8888" \
  https://databay.com/what-is-my-ip

On Windows you can also append the switches to the Target line of a separate shortcut. The new directory starts without your main profile's cookies, history, passwords or extensions. Confirm both switches on chrome://version, keep one directory per route intent, and delete it when the work ends.

The first request reaches the gateway without credentials, the gateway answers 407 Proxy Authentication Required, and Chrome shows a sign-in prompt for the proxy. For HTTP proxies, Chrome supports the same authentication schemes as for destination servers: Basic, Digest, NTLM and Negotiate. Paste the complete username and password. A sticky username adds a session segment, as in USER-zone-residential-countryCode-us-sessionId-abc123. Premium Residential accepts one of country, state, city, ZIP, coordinate or ASN at a time; Residential Flex, Datacenter and Mobile accept a country or continent.

Do not write --proxy-server="http://USER:PASS@gw.databay.co:8888". Chrome ignores embedded credentials, so the password would only land in shell history and on chrome://version.

• Keep the password in a secret store and paste it into the prompt, never into scripts or shortcuts.
• Never screenshot the prompt, chrome://version or a NetLog while a credential is visible, or paste one into tickets or chat.
• Chromium documents that the connection to an HTTP proxy is unencrypted, so avoid entering the password on networks you do not trust.
• To change the username, quit the test instance completely and relaunch it.

Chrome accepts --proxy-server="socks5://proxy.example:1080", but Chromium's proxy documentation states that no authentication methods are supported for SOCKSv5 in Chrome. It also notes that SOCKSv5 always resolves names on the proxy side and carries only TCP-based URL requests. Databay authorizes and routes each connection by username and password, so a SOCKS5 error from gw.databay.co:8888 in Chrome is expected rather than a gateway fault. Use http://gw.databay.co:8888 instead: the HTTP scheme handles http://, https://, ws:// and wss:// URLs and also resolves names at the proxy. Keep SOCKS5 for clients that can send its credentials; the HTTP versus SOCKS5 comparison covers how each protocol handles authentication.

--proxy-bypass-list works only together with --proxy-server and takes semicolon-separated rules: hostname patterns such as *.corp.example or *.org:443, IP literals, ranges such as 192.168.1.1/16, and <local> for hostnames without a dot. Matching needs no dot separator, so *example.com also matches myexample.com. By default, Chrome sends localhost, 127.0.0.1/8, [::1] and link-local addresses direct; <-loopback> removes those implicit rules, which Chromium warns has security implications. In system settings, use the platform's own exclusion format.

To send only approved hosts through Databay, load a PAC file with --proxy-pac-url or through policy:

function FindProxyForURL(url, host) {
  // Approved test hosts and the exit check use the gateway.
  if (dnsDomainIs(host, ".qa-target.example") ||
      host === "databay.com" || host === "api.ipify.org") {
    return "PROXY gw.databay.co:8888";
  }
  return "DIRECT"; // everything else stays direct
}

Match on the host: Chrome strips the path and query from https:// URLs before calling FindProxyForURL(). PAC files are never fetched through a proxy, must return exactly HTTP 200, and cannot carry credentials. A result such as PROXY gw.databay.co:8888; DIRECT moves to the next entry after a connection-level failure, and a PAC file that cannot be fetched falls back to direct connections unless it is mandatory. Omit DIRECT wherever the route is part of the test.

Check the route before the real destination. In the test window, open Databay's What Is My IP page and record the observed IP, country estimate, username variant and UTC time; https://api.ipify.org?format=json or https://databay.com/what-is-my-ip/json gives a second observation. Both describe the exit that served those requests; neither proves anonymity or predicts the next connection.

1. If you used a separate instance, open the same page in your everyday Chrome window; it should still show your direct address.
2. Compare the observed country with the username target. A mismatch is a failed check, not a reason to cycle usernames.
3. You can request sticky windows up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends. All Databay pools are shared, so a repeated address shows continuity, not a reserved IP.
4. Without a session segment, a new proxy connection may select an available exit while a reused connection may keep its exit, so one page's parallel connections can leave through different addresses.
5. Then open the approved destination, starting with a page you own or are permitted to test.

The check covers Chrome's URL requests. WebRTC media normally uses UDP, which the Databay gateway does not carry; administrators can restrict it with Chrome's WebRtcIPHandling policy.

For managed machines, the Chrome Enterprise ProxySettings policy is the supported control: a dictionary with ProxyMode (direct, system, auto_detect, fixed_servers or pac_script), ProxyServer, ProxyPacUrl, ProxyPacMandatory and ProxyBypassList. Once it is set, users cannot change proxy settings and Chrome ignores proxy-related switches; the deprecated standalone ProxyMode policy is ignored too. On Linux, Chrome reads mandatory policy files from /etc/opt/chrome/policies/managed/:

{
  "ProxySettings": {
    "ProxyMode": "fixed_servers",
    "ProxyServer": "gw.databay.co:8888",
    "ProxyBypassList": "*.corp.example,intranet.corp.example"
  }
}

On Windows, deploy the same dictionary through Group Policy with Google's administrative templates. On macOS, deliver mandatory policy for the com.google.Chrome domain through device management; values written with defaults apply only at the recommended level. For PAC, use pac_script with ProxyPacUrl, and set ProxyPacMandatory to true if a failed script must not go direct.

The policy has no credential field, so every user still answers the sign-in prompt; plan how authorized users receive the credential without tickets or chat. Traffic is billed per GB, so scope fleet routes with PAC or exclusions. Afterwards, open chrome://policy, select Reload policies, and confirm the value and source, as Google's policy viewing guide describes.

Chrome shows proxy failures as network error codes. Read each as evidence from one hop: the proxy hop covers TCP to the gateway, the 407 exchange and the CONNECT tunnel; the destination hop covers TLS and the site's HTTP response. Change one variable at a time.

For unclear cases, follow Chromium's NetLog instructions: open chrome://net-export, log to disk, reproduce the problem in another tab, then stop. Keep the default mode that strips private information, leave raw bytes out, and share the file only with people who need it. For automation on the same gateway, continue with the Puppeteer, Selenium or Playwright guide.