requests.exceptions.ProxyError means the failure happened on the proxy leg of the request, not at the target site: the proxy hostname did not resolve, the port refused the connection, or the proxy rejected your CONNECT tunnel. The wrapped inner message tells you which. This guide decodes each variant and fixes the proxies dict, credential, and environment mistakes behind them.
requests raises ProxyError — a subclass of ConnectionError — when the proxied path itself cannot be established. The stack is requests wrapping urllib3, so the useful detail lives in the inner message. Three variants cover most cases: "Cannot connect to proxy" with a NameResolutionError or NewConnectionError means the proxy hostname or port is wrong, or the route is blocked; "Connection refused" or "Connection reset" means nothing is listening there or access was denied; and "Tunnel connection failed: 407" (or 403) means the proxy answered your CONNECT and rejected it — an authentication or permission problem, not connectivity.
The scope is the key insight: ProxyError is about the leg between you and the proxy. If the target site were down you would see ConnectTimeout or a plain ConnectionError without proxy wording. So the debugging surface is small and local: the proxy URL, the credentials, the proxies dict, and the environment variables that can silently override all three.
One near-neighbor to rule out: a socks5:// URL without the SOCKS extra installed raises InvalidSchema ("Missing dependencies for SOCKS support"), not ProxyError — same neighborhood, different fix.
The wrapped inner exception resolves most cases on the first read — start there, then verify configuration layer by layer.
Tunnel connection failed: 407 is credentials, Cannot connect to proxy is host/port/network, and NameResolutionError is a typo in the proxy hostname.http://user:pass@host:port. A missing scheme or stray whitespace breaks parsing without an obvious error.https:// site never consults an http-only dict.urllib.parse.quote: a raw @, :, /, or # in the password corrupts the parsed URL and surfaces as auth failures or garbage hostnames.HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are honored by default and can override your code — set session.trust_env = False to isolate.pip install requests[socks] and prefer socks5h:// so DNS resolves through the proxy rather than locally.The proxies dict trips up nearly everyone once: its keys describe the traffic being proxied, not the proxy. In practice both keys point at the same proxy URL — and that URL's scheme is normally http:// even for HTTPS targets, because requests opens a plaintext connection to the proxy, issues CONNECT, and runs end-to-end TLS through the tunnel. Your payloads stay encrypted; only the tunnel setup is plaintext.
Authentication is the other half. With ProxyOmega, the proxy password is your dashboard API key, and targeting rides on the username — -country-us for geo, -session-job42 for a sticky IP held up to 24 hours, -ttl-600 to cap a session's lifetime in seconds. If you would rather keep credentials out of code entirely, whitelist your server's IP in the dashboard and drop the user:pass from the URL.
Define http and https keys with the same value: http://USERNAME:[email protected]:10000. That single line covers plain and TLS traffic. Since every ProxyOmega port also serves SOCKS5, swapping the scheme to socks5h:// is the only change needed to switch protocols.
API keys are URL-safe, but if you ever embed passwords with special characters, run them through urllib.parse.quote first. For containers and CI, IP whitelisting removes secrets from code and environment entirely — just remember it needs a stable egress IP, or connection resets replace your 407s.
Use requests.Session for connection pooling, and decide IP behavior on the username. Rotating ports on Budget Unlimited (/plan-unlimited/) give a changing exit for crawl-style traffic; a -session- flag keeps one IP across a login-plus-scrape flow. For per-GB jobs with state, city, or ASN targeting, Platinum (/plan-platinum/) uses the same auth scheme.
This setup encodes the password defensively, sets both dict keys, ignores conflicting environment variables, and uses split connect/read timeouts — the combination that avoids ProxyError and its neighbors.
import requests
from urllib.parse import quote
username = "USERNAME-country-us-session-job42"
password = quote("YOUR_API_KEY", safe="")
proxy = f"http://{username}:{password}@residential.proxyomega.com:10000"
proxies = {"http": proxy, "https": proxy}
session = requests.Session()
session.trust_env = False # ignore HTTP_PROXY / NO_PROXY from the environment
r = session.get("https://api.ipify.org", proxies=proxies, timeout=(15, 30))
print(r.status_code, r.text)https:// site only consults the https key — if you set only http, the request goes direct. Environment variables can also interfere: HTTP_PROXY, HTTPS_PROXY, and NO_PROXY are honored by default, so set trust_env = False to isolate your code's config.http:// proxy URL for both dict keys: requests opens a plaintext connection to the proxy, issues CONNECT, and then runs end-to-end TLS to the target through the tunnel. Your traffic stays encrypted. Declaring https:// wraps the proxy hop itself in TLS, which many stacks and plaintext CONNECT ports do not support.pip install requests[socks] — or you will hit InvalidSchema: "Missing dependencies for SOCKS support". Then use socks5h://user:pass@host:port in both dict keys; the h suffix resolves DNS through the proxy. On ProxyOmega, SOCKS5 runs on the same port as HTTP and HTTPS, so only the scheme changes.Username plus API key or IP whitelist — with country targeting and sticky sessions riding on the username, on ProxyOmega's 90M+ IP network.
ProxyOmega 90M+ ethically-sourced IPs across 200+ countries and 30,000+ cities. Residential, mobile, ISP and IPv6 proxies for scraping and AI agents.