How to fix fatal: unable to access: Authentication failed (proxy requires basic auth) in Git

Set up Git to use your proxy server with your username and password included:

# Configure HTTP proxy with credentials
git config --global http.proxy http://username:[email protected]:8080

# Configure HTTPS proxy with credentials
git config --global https.proxy http://username:[email protected]:8080

Replace the values:
- username - Your proxy username (often your corporate/AD username)
- password - Your proxy password
- proxy.example.com - Your proxy server hostname
- 8080 - Your proxy server port

Note that the scheme in the proxy URL (http://) describes how Git talks to the proxy, not the protocol of the repository you are cloning. Most proxies accept plaintext http:// even for HTTPS Git traffic, which it tunnels via CONNECT.

If your password contains special characters, URL-encode them:
- @ becomes %40
- # becomes %23
- ! becomes %21
- $ becomes %24
- & becomes %26

For example, if your password is Pass@123:

git config --global http.proxy http://username:Pass%[email protected]:8080

Heads-up on plaintext storage: these commands write your password in cleartext to ~/.gitconfig. See "Verify and test" below and the Advanced Notes for ways to avoid persisting the password.

Some proxy servers require Git to explicitly offer basic authentication. Set the proxyAuthMethod configuration:

# Tell Git to use basic authentication with the proxy
git config --global http.proxyAuthMethod basic

Git's default authentication method is anyauth, which lets libcurl auto-detect the scheme. Some proxies don't respond well to this negotiation and require the explicit basic method.

Important: proxyAuthMethod only selects *which* scheme is used. It does not supply credentials and Git will not interactively prompt you for proxy credentials. You still need credentials in the proxy URL (Step 1) or in the proxy environment variables (Step 3). Without them, authentication still fails even with basic set.

Available authentication methods:
- anyauth - Auto-detect (default, but may fail with some proxies)
- basic - HTTP Basic Authentication (most common for corporate proxies)
- digest - HTTP Digest Authentication
- negotiate - SPNEGO/Kerberos negotiation
- ntlm - Windows NTLM authentication

After setting this, try your Git operation again:

git fetch origin

Alternatively, you can set proxy settings using environment variables. This is useful for temporary configuration or CI/CD pipelines, and keeps credentials out of ~/.gitconfig:

On Linux/macOS:

# Set proxy for the current session
export http_proxy="http://username:[email protected]:8080"
export https_proxy="http://username:[email protected]:8080"
export HTTP_PROXY="$http_proxy"
export HTTPS_PROXY="$https_proxy"

# Now run your Git command
git clone https://github.com/user/repo.git

To avoid putting the password in your shell history, prompt for it instead:

read -rs PROXY_PASS
export https_proxy="http://username:[email protected]:8080"
export http_proxy="$https_proxy"

On Windows (Command Prompt):

set http_proxy=http://username:[email protected]:8080
set https_proxy=http://username:[email protected]:8080
git clone https://github.com/user/repo.git

On Windows (PowerShell):

$env:http_proxy = "http://username:[email protected]:8080"
$env:https_proxy = "http://username:[email protected]:8080"
git clone https://github.com/user/repo.git

Git (via libcurl) reads these variables automatically, so you may not need any git config proxy settings at all when they are present.

After configuring the proxy, verify your settings and test the connection:

Check current proxy configuration:

# Show proxy-related Git configuration
git config --global --get http.proxy
git config --global --get https.proxy
git config --global --get http.proxyAuthMethod

# Show all Git configuration with locations
git config --list --show-origin | grep -i proxy

Test the connection with verbose output:

# Enable curl verbose mode to see connection details (including the 407 response)
GIT_CURL_VERBOSE=1 git ls-remote https://github.com/git/git.git

# Or enable full Git tracing
GIT_TRACE=1 GIT_CURL_VERBOSE=1 git fetch origin

Test with curl directly (to isolate Git issues):

# Test proxy connection with curl
curl -v --proxy http://username:[email protected]:8080 https://github.com

If curl succeeds but Git fails, the problem is in Git's proxy configuration rather than the proxy or network itself.

If you only need the proxy for certain hosts (e.g., external repositories), you can configure URL-specific proxy settings:

# Use proxy only for GitHub
git config --global http.https://github.com/.proxy http://username:[email protected]:8080
git config --global http.https://github.com/.proxyAuthMethod basic

# Use proxy only for an internal GitLab
git config --global http.https://gitlab.company.com/.proxy http://username:[email protected]:8080
git config --global http.https://gitlab.company.com/.proxyAuthMethod basic

Exclude certain hosts from the proxy:

# Bypass the proxy for internal/loopback hosts (Git 2.13+ honors NO_PROXY-style lists)
export no_proxy="localhost,127.0.0.1,.company.internal"

# Or disable the proxy for a specific URL in Git config by setting it empty
git config --global http.https://internal.company.com/.proxy ""

This lets you route external traffic through the proxy while reaching internal resources directly.

If you're having persistent issues, clear all proxy settings and start fresh. Use --unset-all to remove any duplicated or URL-specific entries:

# Remove global proxy settings (use --unset-all to clear duplicates)
git config --global --unset-all http.proxy
git config --global --unset-all https.proxy
git config --global --unset-all http.proxyAuthMethod

# Clear environment variables (current session)
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY

# Verify settings are cleared
git config --list | grep -i proxy

> Note: git config --unset fails with "key contains multiple values" if a key was set more than once, which is why --unset-all is preferred here.

Then reconfigure from scratch:

git config --global http.proxy http://username:[email protected]:8080
git config --global https.proxy http://username:[email protected]:8080
git config --global http.proxyAuthMethod basic

# Test
git ls-remote https://github.com/git/git.git

If your corporate proxy uses NTLM authentication (common in Windows/Active Directory environments), basic auth will not work. Use CNTLM as a local intermediary proxy that handles NTLM for you:

Install CNTLM:

# On Ubuntu/Debian
sudo apt install cntlm

# On macOS
brew install cntlm

# On Windows - download from http://cntlm.sourceforge.net/

Generate a password hash first (avoids storing the cleartext password):

cntlm -H -d COMPANY -u your_username
# Enter password when prompted; copy the PassNTLMv2 line into the config below

Configure CNTLM (`/etc/cntlm.conf` or `cntlm.ini`):

Username    your_username
Domain      COMPANY
# Prefer the hashed value over a plaintext Password line
PassNTLMv2  <hash-from-cntlm-H>
Proxy       proxy.company.com:8080
Listen      3128

Start CNTLM and point Git at it:

# Start CNTLM
sudo systemctl start cntlm

# Configure Git to use the local CNTLM proxy (no credentials needed in Git)
git config --global http.proxy http://127.0.0.1:3128
git config --global https.proxy http://127.0.0.1:3128

CNTLM performs the NTLM handshake with the corporate proxy, and Git connects through it with a simple unauthenticated local proxy URL.