Windows 11 Proxy Settings: Setup, WinHTTP and 407 Fixes

Windows 11 proxy settings live under Settings > Network & internet > Proxy, which Microsoft's diagnostic data guidance identifies as the user-level (WinINET) proxy. WinHTTP keeps a separate machine-wide configuration managed with netsh winhttp, and the WinHttpOpen reference states that its default proxy mode does not inherit browser proxy settings. Command-line tools add a third source.

Databay's gateway, gw.databay.co on port 8888, handles HTTP proxying, HTTPS CONNECT tunnelling and SOCKS5, with no UDP. The Windows controls here are HTTP proxy settings, and neither the Settings page nor netsh has a field for the Databay username and password. Use the route only for destinations you own or are permitted to access, and follow each destination's terms.

These steps follow Microsoft's Use a proxy server in Windows article, which covers Wi-Fi and Ethernet connections. On a managed device, follow your administrator's policy instead of overriding it.

1. Open Settings > Network & internet > Proxy.
2. Under Manual proxy setup, next to Use a proxy server, select Set up.
3. In Edit proxy server, turn on Use a proxy server, fill in the fields below, and select Save.

Automatically detect settings lets Windows discover a configuration on the network, and Use setup script points it at a script address your organization hosts; a fixed host and port needs neither. A VPN connection that uses a proxy needs its own entry under the connection's Advanced options, next to Proxy settings for this VPN connection.

Windows stores only a host and port, so routing choices travel in the username from your Databay dashboard. The documented pattern is USER-zone-residential-countryCode-us; a sticky session adds a segment, as in USER-zone-residential-countryCode-us-sessionId-abc123. Copy the complete username the dashboard shows rather than composing grammar for another pool.

• Premium Residential: one of country, state, city, ZIP, coordinate or ASN at a time.
• Residential Flex, Datacenter and Mobile: country or continent.
• Request sticky windows up to 1440 minutes on Premium Residential and Residential Flex where available, or up to 120 minutes on Datacenter and Mobile. The IP can change before the window ends.

Pools are shared. A new proxy connection may select an available exit and a reused connection or tunnel may keep it, so a different address is never promised. An app that cached an earlier credential can keep sending it, so restart the app before testing a new route. Databay bills traffic per GB, and everything that follows the system entry goes to the gateway, including Windows components: Microsoft documents that Delivery Optimization uses the Windows proxy while a user is signed in. Turn the proxy off when the authorized task ends.

A proxy that needs credentials answers with 407 Proxy Authentication Required and a Proxy-Authenticate header, as Authentication in WinHTTP describes. Microsoft's WinINet vs. WinHTTP comparison lists credential prompting and a credential cache for WinINet only, and service support for WinHTTP only. An interactive app can prompt you, while a WinHTTP service must supply credentials from its own code, per request, without caching.

• Enter it deliberately. Type the full dashboard username and password only into a prompt that names gw.databay.co, and cancel unexpected proxy prompts.
• Know where it is saved. Each app decides whether to remember it. Credential Manager lets you view and delete saved credentials for websites, connected applications and networks: search the taskbar for credential manager, then check Web Credentials and Windows Credentials for gateway entries. Browser password managers keep separate stores.
• Keep it out of evidence. Use a password manager or secret store, keep the password out of screenshots, tickets, chat and logs, and rotate it after any exposure.
• Treat Basic as readable. Microsoft notes that Basic authentication sends the user name and password in clear text, base64-encoded. Destination TLS protects content inside the CONNECT tunnel, not the header sent to the gateway, so prefer trusted networks.

Change the machine-wide WinHTTP setting only when a specific service needs it, because every WinHTTP program in default proxy mode follows it. In an elevated terminal, record the current value, apply the change, and restore it afterward, using the netsh winhttp reference:

netsh winhttp show proxy
netsh winhttp set proxy gw.databay.co:8888 "<local>"
netsh winhttp reset proxy

The positional set proxy form takes the server, then a semicolon-separated exception list in which <local> covers short host names; reset proxy returns WinHTTP to DIRECT. netsh winhttp import proxy source=ie instead copies the per-user settings; run show proxy to see what arrived.

Neither command takes a username or password. Microsoft's Delivery Optimization proxy guidance says set proxy offers no auto-detection, no explicit PAC URL support and no authentication to the proxy, and that imported settings share those limits. A service routed this way meets the 407 and fails unless its own configuration supplies credentials, so prefer the service's documented proxy option. The Win32 netsh reference also marks set proxy and show proxy deprecated in favor of set advproxy and show advproxy, which take user or machine scope and a JSON object with the properties it lists.

Neither the Settings page nor netsh writes HTTP_PROXY, HTTPS_PROXY or NO_PROXY; each tool decides whether to read them. PowerShell 7 is a documented example: Invoke-RestMethod reads them, plus ALL_PROXY, on Windows and falls back to the user's proxy settings when they are absent. Start with session-only values:

$Env:HTTPS_PROXY = 'http://gw.databay.co:8888'
$Env:HTTP_PROXY  = 'http://gw.databay.co:8888'
$Env:NO_PROXY    = 'localhost,127.0.0.1'
# run the authorized job, then:
Remove-Item -Path Env:\HTTPS_PROXY, Env:\HTTP_PROXY, Env:\NO_PROXY

PowerShell's documentation confirms these assignments last only for the current session and its child processes. setx HTTPS_PROXY "http://gw.databay.co:8888" persists a value in the registry for future windows; the setx reference notes that it leaves the current window unchanged, that /m targets the system environment, and that values over 1,024 characters are cropped.

Many tools also accept http://USER:PASS@gw.databay.co:8888. Avoid that form: reserved characters need encoding, child processes inherit the password, diagnostics can print it, and setx would store it in the registry. Keep the username and password in separate secret-backed variables such as $Env:DATABAY_PROXY_USER and let each tool assemble the credential at run time, as the cURL, Python Requests and Node.js fetch guides show. Note that the Windows exception list uses semicolons while NO_PROXY uses commas.

The gateway accepts SOCKS5 on the same host and port, but the Windows system proxy cannot use it. The Edit proxy server dialog has no protocol selector and no credential fields, Microsoft's WinINet vs. WinHTTP comparison lists SOCKS5 as unsupported in both stacks, and the Win32 netsh reference says SOCKS5 isn't supported for set advproxy. WinINet lists SOCKS4 support only, without 4a, and SOCKS4 has no password field for a Databay credential.

Configure SOCKS5 in the application's own proxy settings with username and password fields, or on the command line, for example cURL with socks5h://gw.databay.co:8888 and --proxy-user. Keep the system proxy out of that test, see HTTP versus SOCKS5 proxies for DNS trade-offs, and remember that the gateway does not carry UDP.

Prove the route on an IP endpoint before opening the destination you are authorized to use. In a browser that follows the system proxy, open Databay's What Is My IP page, answer the gateway prompt, and record the observed address, country estimate and time; compare it with the same page loaded with the proxy off. To test the credential without touching system settings, use PowerShell 7:

$cred = Get-Credential -Message 'Databay proxy username and password'
Invoke-RestMethod -Uri 'https://databay.com/what-is-my-ip/json' `
  -Proxy 'http://gw.databay.co:8888' -ProxyCredential $cred -TimeoutSec 20
Invoke-RestMethod -Uri 'https://api.ipify.org?format=json' -NoProxy -TimeoutSec 20

Get-Credential keeps the password off the command line; in automation, read it from your secret store instead. The first call shows the exit observed for that request and the second your direct address. A matching country is one endpoint's estimate, not proof of anonymity. For sticky sessions, repeat the check at workflow checkpoints and record any change, and open the real destination only when the observation matches the requested route. For a WinHTTP service, netsh winhttp show proxy shows configuration, not what the service used; confirm the route in the service's own logs.

Find the first failed layer before changing anything. The proxy hop covers TCP to gw.databay.co:8888, the 407 exchange and the CONNECT tunnel; the destination hop starts with TLS inside the tunnel and ends with the HTTP status.

To back out, turn off Use a proxy server and select Save, run netsh winhttp reset proxy if you changed WinHTTP, remove proxy variables (a persisted one with [Environment]::SetEnvironmentVariable('HTTPS_PROXY', '', 'User')), and delete saved gateway credentials. Never share a screenshot or log that shows the credential.