iPhone Proxy Settings: Wi-Fi Proxy Setup for iOS and iPad

On iPhone and iPad, a proxy belongs to one Wi-Fi network. Apple's user guides list HTTP Proxy, with DNS, among the settings of a joined network, reached from Wi-Fi and the network's Info button. Other Wi-Fi networks, a Personal Hotspot and cellular data do not inherit the entry.

It is an HTTP proxy setting with no SOCKS5 field. Databay's gateway, gw.databay.co on port 8888, serves HTTP proxying, HTTPS CONNECT tunnelling and SOCKS5 from one endpoint, and the Settings app uses its HTTP side. For an https:// page the gateway opens a CONNECT tunnel, so TLS still runs between the device and the site.

Use the route only for destinations you own or are permitted to test, such as your own mobile site, a staging API or an approved ad check, and follow each destination's terms. The proxy changes the network path a destination observes; it does not change the device's region, language, time zone or Location Services.

Copy each value from the Databay dashboard instead of rebuilding it from an example. The username carries the product, location and any sticky session, so a truncated username is a different request, not a typo the gateway can repair.

Network          QA-Lab
Configure Proxy  Manual
Server           gw.databay.co
Port             8888
Authentication   On
Username         USER-zone-residential-countryCode-us
Password         PASS (from the dashboard)

Choose the product before copying the username. Premium Residential accepts one of country, state, city, ZIP, coordinate or ASN at a time; Residential Flex, Datacenter and Mobile accept a country or continent. A sticky session adds a segment, as in USER-zone-residential-countryCode-us-sessionId-abc123. Copy the exact form the dashboard shows rather than inventing segments for another pool, and compare the mobile proxy network with residential proxies before ordering.

1. Join the Wi-Fi network you will work on and confirm the checkmark sits on it. Apple notes that iPhone joins known networks automatically and uses cellular data when Wi-Fi isn't available.
2. Open the Settings app, tap Wi-Fi, then tap the Info button next to that network.
3. Scroll to HTTP Proxy and tap Configure Proxy.
4. Choose Manual, then enter gw.databay.co in Server and 8888 in Port.
5. Turn on Authentication and paste the complete username and password into Username and Password.
6. Tap Save and run the Safari check below before opening any real destination.

Apple's guides, for iPhone and iPad alike, describe this step only as configuring HTTP Proxy and entering the details. The labels above are the ones recent releases display; if your build words one differently, match it by function: server, port, authentication switch, user name and password. When the work ends, set the proxy back to off on the same screen.

The other mode, Automatic, takes the URL of a proxy auto-configuration (PAC) file. Apple's device-management reference draws the same line: the manual type carries a server, port and optional user name and password, while the automatic type takes a PAC URL, and its Global HTTP Proxy reference says the user name and password are ignored in automatic mode. A PAC file can name gw.databay.co:8888 but cannot hold the dashboard credentials the gateway expects, so expect a credential prompt or a 407 failure. Use Manual for Databay, and test any existing organizational PAC file on one non-sensitive page first.

SOCKS5. Settings has no SOCKS5 field, and Apple's Wi-Fi payload has no SOCKS key. On iPhone and iPad, SOCKS5 is an app feature: Apple's Network framework proxy configuration lets developers define a SOCKSv5 proxy inside their own app on iOS 17 and later. Use Databay's SOCKS5 endpoint only in an app whose documentation describes a SOCKS5 option, and verify that app separately. The HTTP versus SOCKS5 comparison covers the protocol differences.

Cellular data. The entry applies only to the Wi-Fi network you edited. Apple documents that Connectivity Assist, under Wi-Fi settings, uses cellular data along with Wi-Fi when Wi-Fi is weak or busy. Traffic sent over cellular does not use this entry, so turn Connectivity Assist off while verifying.

Every app. Safari follows the setting, and Apple's URLSessionConfiguration reference says sessions without their own proxy dictionary use the system settings. Apps with their own networking or proxy setting, traffic inside an active VPN, and UDP traffic can ignore the entry or fail; the gateway has no UDP path.

Background traffic. Traffic is billed per GB, and any app or service that honors the proxy on that network spends from the same plan. Apple's Low Data Mode switch on the network screen helps reduce that use.

1. With the proxy off, open https://databay.com/what-is-my-ip in Safari and note the address as your direct baseline.
2. Save the Manual entry and reload. Record the observed IP, country estimate, ASN, UTC time, network name and iOS version.
3. Confirm the address differs from the baseline and the country matches the request. https://databay.com/what-is-my-ip/json gives the same observation as JSON, and https://api.ipify.org?format=json is a second observer.
4. Only then open the authorized destination, and check each app the work depends on.

If iCloud Private Relay is active, Safari traffic can travel through Apple's relays and the page may report a relay address instead of your route. Apple's Private Relay network guidance explains turning it off for one network with the Limit IP Address Tracking switch on the same screen; record that state and disconnect any VPN. The What Is My IP tool reports an observed exit, not proof of anonymity.

Browsers open several connections and reuse them. A new proxy connection may select an available exit while a reused one may keep the current exit, so without a session segment two reloads can match or differ. For interactive work, use a sticky username and recheck at checkpoints. Sessions can be requested for up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends. Pools are shared, so a session is temporary continuity, not a reserved address.

If Authentication is off, the password is wrong or the username is truncated, the gateway replies with 407 Proxy Authentication Required. Safari may show a sign-in prompt for the proxy, while many apps only report a network error. Enter credentials only into a system prompt that names gw.databay.co, never into a web page, and fix the saved fields instead of answering each prompt.

Keep the password in a password manager or your organization's secret store. Never screenshot or screen-record the proxy screen, or paste the values into chat, tickets or logs. The username is sensitive too, since it identifies the account and its routing. Anyone with the unlocked device can open that screen, so remove the entry when the work ends and rotate the credential after any exposure.

For managed fleets, Apple documents proxy keys in the Wi-Fi payload, com.apple.wifi.managed, delivered by a device-management service or a manually installed configuration profile. ProxyType accepts None, Manual or Auto; ProxyServer, ProxyServerPort, ProxyUsername and ProxyPassword carry the manual values; ProxyPACURL and ProxyPACFallbackAllowed serve the automatic type. Each payload describes one network, usually by SSID_STR, and a device can hold several.

<dict>
  <key>PayloadType</key>
  <string>com.apple.wifi.managed</string>
  <key>SSID_STR</key>
  <string>QA-Lab</string>
  <key>ProxyType</key>
  <string>Manual</string>
  <key>ProxyServer</key>
  <string>gw.databay.co</string>
  <key>ProxyServerPort</key>
  <integer>8888</integer>
  <key>ProxyUsername</key>
  <string>USER-zone-residential-countryCode-us</string>
  <key>ProxyPassword</key>
  <string>PASS</string>
  <!-- plus PayloadIdentifier, PayloadUUID, PayloadVersion and the network security keys -->
</dict>

A profile containing ProxyPassword is a credential file: deliver it through the management service, never by email or a repository. Apple's deployment guide warns that disabling captive network detection in this payload leaves users no opportunity to join networks that require agreements first, so do not enable that option for networks with a sign-in page.

When a supervised device needs one proxy for all HTTP traffic rather than one Wi-Fi network, Apple documents the Global HTTP Proxy payload, com.apple.proxy.http.global, limited to one per device; its ProxyCaptiveLoginAllowed key lets a captive network's login page load outside the proxy. Confirm field names in your management vendor's console.

Change one thing at a time and keep the failed observation. Decide which hop produced it: the Wi-Fi network, the proxy hop (connection, 407 authentication, CONNECT) or the destination hop (TLS, then HTTP status).

To separate the device from the gateway, try the same credentials once from a computer on the same network. If that fails too, the cause is the network path or the credential, not iOS:

curl --proxy http://gw.databay.co:8888 \
  --proxy-user "$DATABAY_PROXY_USER:$DATABAY_PROXY_PASS" \
  --connect-timeout 5 --max-time 20 \
  https://databay.com/what-is-my-ip/json

Inject both variables from a secret store rather than shell history. The cURL proxy setup guide explains how to read 407 and CONNECT evidence in verbose output.