IP whitelisting: proxies with no password, for machines that have a fixed address

Two ways in, and when to use which

Every PyProxy account has both. They route through the same gateway and draw from the same balance; the only difference is how the gateway recognises you.

The practical reason to have both: test with a password from your own machine, then whitelist the server once the job goes into production. Same account, same balance, no plan change.

Set it up in a minute

1. Open the panel. Sign in at pyproxy.com/login and find the IP authentication card. It already shows the public address you are connecting from right now, so you can see what a whitelist entry looks like before adding one.
2. Add the machine's address. Type the IPv4 address of the server that will use the proxy. If you are sitting on that server, the shown address is the one. Give it a label if you run several — “scraper-01”, “ci” — so you recognise them later.
3. Pick country and session mode. Both are optional and belong to that address only. Leave country empty for a worldwide pool, or set a two-letter code such as US or DE. Turn on sticky if the machine needs to keep one exit IP across requests (logins, multi-step forms); leave it off for a fresh address every request.
4. Point your software at port 8081. Host gw.pyproxy.com, port 8081, proxy type HTTP, and leave the username and password fields empty. Changes take effect within fifteen seconds; there is nothing to restart on our side.

# nothing to hide in this command: the address does the authenticating
curl -x http://gw.pyproxy.com:8081 https://api.ipify.org

# Python, requests
proxies = {"http": "http://gw.pyproxy.com:8081", "https": "http://gw.pyproxy.com:8081"}
requests.get("https://example.com", proxies=proxies, timeout=30)

Which address to add

The one a website sees when that machine connects to it. Three addresses get confused with it, and each produces the same refusal:

• Not a LAN address. Anything starting 192.168., 10. or 172.16–31. is your router's private network. The panel refuses these outright, because we would never see a connection from them.
• Not the proxy's own address. The exit IP a site sees while you use the proxy is ours, and it changes. You whitelist the machine behind the proxy, not the one in front.
• Not your laptop, when the server will do the work. Every machine that connects needs its own entry. Add the server's address from the server — the panel's “you are connecting from” line makes that a copy-and-paste.

From any machine, the free IP check tool prints the public address and its provider. If the provider column names a cloud host, you are looking at your server; if it names a home ISP or a mobile carrier, read the next section before whitelisting anything.

Why it works today and fails tomorrow

Home and mobile connections have dynamic addresses. The ISP hands you one, and swaps it on a reboot, a line drop or simply on a schedule. Whitelisting such an address is a promise the connection cannot keep: the proxy works until the address changes, then every request comes back 407 with the new, unknown address in the body.

Two variants are worse. Behind carrier-grade NAT, common on mobile data and on some fibre providers, you share one public address with hundreds of neighbours; it still rotates, and until it does, everyone behind it is you as far as the whitelist knows. And a VPN on the same machine moves your public address to the VPN's exit, so the entry stops matching the moment the VPN connects or drops.

Country and sticky sessions, per address

An entry is not just an address; it carries the targeting that a password user would put in the username. Two servers in one account can have different countries and different session modes, and each connects with the same empty credentials.

Sticky mode ties the exit IP to the connecting machine. Two whitelisted servers with sticky on receive two different exits and keep them; they never share one, and you never see one server's session hop because the other made a request. The exit is held for as long as the network keeps it alive, and a new one is issued when it goes.

Need a different country for one job on the same server? Change the entry in the panel; the next connection, within fifteen seconds, uses the new setting. For several countries from one machine at the same time, use password logins on port 1111, where each line carries its own tag.

Limits worth knowing before you plan around it

Every refusal, decoded

Port 8081 answers refusals with a plain-text body rather than a bare code, because a client with no password to offer would otherwise just retry for ever. Read the body.

When the password is the better choice

Whitelisting removes a secret from a config file, and that is its whole advantage. Everything else favours credentials: they work from any address, carry per-line targeting, cover SOCKS5, and never break because an ISP rotated something at 3 a.m. Antidetect browser profiles in particular should use credentials — a profile is meant to look like an independent person, and a whole fleet of profiles authenticating from one whitelisted office address is the opposite of that. The SOCKS5 setup guide covers the per-device steps for the password route.

Related: What is my IP · SOCKS5 on PyProxy · Locations · FAQ

IP whitelisting questions