curl Proxy: Flags, Auth, SOCKS5, and Verification

To send a request through a proxy, pass -x (or --proxy) with the full proxy URL, credentials included: curl -x "http://user:pass@host:port" https://example.com. Credentials can also go in --proxy-user user:pass. Every other proxy feature in curl (SOCKS5, tunneling, environment variables, bypass rules) is a variation on that one flag.

The basic curl proxy command

curl -x "http://user:[email protected]:8000" https://ipinfo.io/json

The scheme in the proxy URL matters. http:// means "talk HTTP to the proxy" and is the default if you omit it. https:// means the connection to the proxy itself is TLS-encrypted. socks5:// and socks5h:// switch to the SOCKS protocol. The scheme of the target URL is independent: an HTTP proxy can carry HTTPS requests.

On VoidMob's shared pool the flex gateway is proxy.voidmob.com:10092, and the geo and session controls ride in the username as underscore parameters:

curl -x "http://<username>_c_US:<password>@proxy.voidmob.com:10092" https://ipinfo.io/json

The <username> and <password> values come from POST /v1/proxies/:id/flex_credentials, so the snippet only works after the package is provisioned. If you use named proxy lists instead, geo and rotation are set on the list and you connect on port 10000 with the credentials returned for that list.

Two encoding rules break more curl commands than anything else:

• Country codes are uppercase. _c_US matches, _c_us does not.
• Quote the whole proxy string. Passwords and parameters contain characters your shell will happily expand or split on. Use double quotes, and percent-encode @ : / ? # if they appear in the password.

Proxy authentication in curl

Three equivalent forms, in decreasing order of how much they leak:

# 1. Inline (shows up in shell history and process list)
curl -x "http://user:[email protected]:10092" https://ipinfo.io/json

# 2. Separate flag
curl -x "http://proxy.voidmob.com:10092" --proxy-user "user:pass" https://ipinfo.io/json

# 3. Password prompt: omit the password, curl asks for it
curl -x "http://proxy.voidmob.com:10092" --proxy-user "user" https://ipinfo.io/json

curl defaults to Basic proxy auth. --proxy-basic, --proxy-digest and --proxy-ntlm force a scheme if the proxy requires one. A 407 Proxy Authentication Required response means the credentials never arrived or were wrong, not that the target blocked you.

HTTPS through an HTTP proxy

When the target URL is https://, curl asks the proxy for a CONNECT tunnel and then negotiates TLS end to end with the target. The proxy sees the hostname and the byte counts, not the plaintext. That is why TLS fingerprints survive a proxy hop untouched: the handshake is yours, which matters if the target profiles clients by JA3 or JA4.

-p / --proxytunnel forces the tunnel even for non-HTTPS targets, which you need when running a non-HTTP protocol over an HTTP proxy. Add -v to watch the exchange: a healthy run shows CONNECT tunnel established, response 200 before the TLS lines.

SOCKS5 with curl

curl -x "socks5h://<username>:<password>@proxy.voidmob.com:$SOCKS_PORT" https://ipinfo.io/json

Use socks5h://, not socks5://. The h sends the hostname to the proxy for resolution; plain socks5:// resolves DNS locally, which leaks the target to your local resolver and often returns the wrong geo-aware answer. --socks5-hostname host:port is the older equivalent.

All VoidMob plans support HTTP and SOCKS5, but the SOCKS port is issued per order with your credentials, so read it from the dashboard rather than assuming a number. If you are choosing between the two protocols for a workload, SOCKS5 vs HTTP vs HTTPS covers the performance difference.

Environment variables and .curlrc

curl reads proxy settings from the environment when no -x is given:

export http_proxy="http://user:[email protected]:10092"
export https_proxy="http://user:[email protected]:10092"
export ALL_PROXY="http://user:[email protected]:10092"
curl https://ipinfo.io/json

One gotcha: http_proxy is honored in lowercase only, while the others accept either case. To make the proxy permanent for your user without exporting variables, put the flag in ~/.curlrc:

proxy = "http://user:[email protected]:10092"

A command-line -x overrides both the file and the environment. -q ignores .curlrc entirely.

Turning the proxy off for one request

curl --noproxy "*" https://ipinfo.io/json          # ignore all proxy settings
curl --noproxy "example.com,10.0.0.0/8" https://api.internal/health
export NO_PROXY="localhost,127.0.0.1"              # same idea, environment form

--noproxy "*" is the fastest way to answer "is it the proxy or the target?" when a request starts failing. If the direct request succeeds and the proxied one does not, the problem is upstream of the target.

Verify the exit IP before you run volume

One request to an IP echo endpoint tells you whether geo targeting, session pinning and auth all worked:

curl -s -x "http://<username>_c_US:<password>@proxy.voidmob.com:10092" https://ipinfo.io/json

Compare that output to what your own machine returns with --noproxy "*". If the country, ASN or carrier is not what you asked for, fix the parameter case before blaming the pool. For ad and pricing checks where the answer depends on the exit being a real local carrier IP, the deeper version of this workflow is in mobile proxies for ad verification.

Holding one IP across several curl calls

Each curl invocation is a new process, so per-request rotation gives you a different exit IP on every line of a shell script. That breaks anything with a login or a multi-step form. On the flex gateway, add a session parameter to the username and reuse it:

SESS="_s_run1_ttl_30m"
curl -c jar.txt -x "http://<username>_c_US${SESS}:<password>@proxy.voidmob.com:10092" https://example.com/login
curl -b jar.txt -x "http://<username>_c_US${SESS}:<password>@proxy.voidmob.com:10092" https://example.com/account

Same session ID, same device, until the TTL runs out. Without _ttl_, the session expires after 60 minutes of inactivity. Change the string to get a new device. Keep the cookie jar and the session ID paired: a cookie set on one IP and replayed from another is the classic self-inflicted flag. More on window lengths in sticky sessions, and on the rotating half in USA rotating proxies.

Reading curl's proxy errors

curl's exit code tells you which hop failed, which saves guessing.

If curl works but a browser automation stack does not, the proxy string is rarely the issue. Compare against the library-specific setup in Playwright proxy setup or Selenium proxy setup, or run the credentials through the Proxy Validator to isolate the variable.