Protocols

Explore supported Residential Proxy protocols and learn how to configure HTTP, HTTPS, HTTPS/3, and SOCKS5 connections.

Oxylabs Residential Proxies support HTTP, HTTPS, HTTP/3, and SOCKS5 connection protocols. You can choose the protocol that best fits your scraping stack, HTTP library, or third-party software.

Protocol

Gateway

Transport

Description

HTTP

pr.oxylabs.io:7777

TCP

Default connection method supported by all libraries and tools.

HTTPS

https://pr.oxylabs.io:7777

TCP / SSL

Fully encrypted connection to the proxy gateway.

HTTP/3

socks.pr.oxylabs.io:7777

UDP / QUIC

Requires a SOCKS5 proxy with UDP support.

SOCKS5

socks5h://pr.oxylabs.io:7777

TCP / UDP

Low-level proxying. Requires username flags for geo-targeting.

HTTP

The standard HTTP protocol is the primary connection method for Oxylabs Residential Proxies that's supported out of the box by all HTTP client libraries, web scraping frameworks, and third-party tools.

Code examples

curl -x pr.oxylabs.io:7777 -U "customer-USERNAME:PASSWORD" https://ip.oxylabs.io/location

import requests

proxies = {
    'http': 'http://customer-USERNAME:PASSWORD@pr.oxylabs.io:7777',
    'https': 'http://customer-USERNAME:PASSWORD@pr.oxylabs.io:7777',
}

response = requests.get('https://ip.oxylabs.io/location', proxies=proxies)
print(response.text)

<?php
$username = 'USERNAME';
$password = 'PASSWORD';
$proxy = 'pr.oxylabs.io:7777';

$query = curl_init('https://ip.oxylabs.io/location');
curl_setopt($query, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($query, CURLOPT_PROXY, "http://$proxy");
curl_setopt($query, CURLOPT_PROXYUSERPWD, "customer-$username:$password");
$output = curl_exec($query);
curl_close($query);
echo $output;
?>

HTTPS

Connecting via HTTPS provides an end-to-end encrypted SSL connection to the proxy entry node. To enable HTTPS proxying, add https:// to your proxy entry point (e.g., https://pr.oxylabs.io:7777). Same applies when using HTTPS with country-specific entry nodes.

Verify that your specific HTTP client library or 3-rd party tool supports HTTPS protocol before use, as legacy tools may default to unencrypted HTTP proxy connections.

Code examples

curl -x https://pr.oxylabs.io:7777 -U "customer-USERNAME:PASSWORD" https://ip.oxylabs.io/location

import requests

proxies = {
    'http': 'https://customer-USERNAME:PASSWORD@pr.oxylabs.io:7777',
    'https': 'https://customer-USERNAME:PASSWORD@pr.oxylabs.io:7777',
}

response = requests.get('https://ip.oxylabs.io/location', proxies=proxies)
print(response.text)

const axios = require('axios');

axios.get('https://ip.oxylabs.io/location', {
  proxy: {
    protocol: 'https',
    host: 'pr.oxylabs.io',
    port: 7777,
    auth: {
      username: 'customer-USERNAME',
      password: 'PASSWORD'
    }
  }
})
.then(response => console.log(response.data))
.catch(error => console.error(error));

HTTP/3 (MASQUE)

Note: Google is a restricted target to use with UDP connection.

Oxylabs Residential Proxies support native UDP and HTTP/3 tunneling via MASQUE (RFC 9298 CONNECT-UDP).

Traditional proxies force traffic through TCP connections (via HTTP CONNECT or SOCKS5), causing HTTP/3 requests to downgrade to HTTP/1.1 or HTTP/2. MASQUE maintains an end-to-end QUIC connection through our residential exit nodes, allowing your client to transmit native UDP traffic directly to modern target destinations.

The MASQUE service runs over QUIC on a dedicated UDP port:

masque.oxylabs.io:50000

Note: Ensure your firewall allows outbound UDP traffic on port 50000.

Use cases

Native HTTP/3 Web Scraping: Scrape modern target websites without triggering protocol downgrade flags.
DNS Resolution over UDP: Execute direct DNS queries (53/udp) via residential IPs.
Real-Time UDP Protocols: Route WebRTC, SIP, or gaming traffic requiring true UDP connection.

Note: If your scraping application only needs standard HTTP or HTTPS (TCP) connections, use our main backconnect endpoint (pr.oxylabs.io:7777). MASQUE introduces QUIC connection setup overhead that is only necessary when you require UDP or native HTTP/3 transport.

MASQUE setup

For full setup, configuration, authentication details, see the technical setup guide below.

MASQUE Setup & Configuration

Proxy endpoint

masque.oxylabs.io:50000

Dedicated QUIC entry node

Transport

HTTP/3 over QUIC

Uses UDP port 50000

ALPN

h3

Application-Layer Protocol Negotiation string

Datagram support

EnableDatagrams: true

Must be enabled in your client's QUIC setup

Max datagram size

1500 bytes

Datagrams exceeding 1500 bytes are dropped by the proxy

TLS verification

Standard Public CA

No custom CA certificates or overrides required

Endpoint configuration & URI formats

To establish a tunnel, your client sends a CONNECT request with :protocol = connect-udp to the proxy listener:

RFC 9298 Standard (Recommended): https://masque.oxylabs.io:50000/.well-known/masque/udp/{target_host}/{target_port}/
Legacy Query Format: https://masque.oxylabs.io:50000/masque?h={target_host}&p={target_port}

Hostnames & IPs: The proxy resolves hostnames on your behalf through the residential exit node. You can pass domain names (example.com) or IP addresses (1.2.3.4). IPv6 addresses must be percent-encoded (e.g., 2001%3Adb8%3A%3A1).

Authentication

Authentication is handled via standard HTTP Basic authentication using the Proxy-Authorization header sent on the CONNECT-UDP request:

Proxy-Authorization: Basic Base64(customer-USERNAME[-key-value]:PASSWORD)

You use your standard Oxylabs proxy credentials. Location settings and session parameters function identically to standard HTTP/HTTPS proxies. For example:

Proxy-Authorization: Basic customer-myuser-cc-us-sessid-abc123:PASSWORD

Nested QUIC & packet size

When using HTTP/3 through MASQUE, a second QUIC stack runs over the proxy tunnel (nested QUIC). The outer connection (client-to-proxy) wraps inner connection packets (client-to-target), adding ~40 bytes of protocol framing overhead.

You must manually configure packet sizes and disable Path MTU Discovery (PMTUD) on both client QUIC stacks. If skipped, the initial inner handshake packet will exceed outer datagram limits and be silently dropped by the proxy, causing the connection to hang indefinitely.

To set up your connection correctly, adjust the following:

Disable PMTUD: Turn off Path MTU Discovery on both outer and inner QUIC connections to enforce fixed packet limits.
Outer QUIC (Client-to-Proxy): Set initial/maximum packet size to 1392 bytes.
Inner QUIC (Client-to-Target): Set initial/maximum packet size to 1352 bytes.

The ~40-byte difference supports outer QUIC headers, AEAD encryption tags, DATAGRAM frame headers, HTTP-datagram framing under RFC 9297, and CONNECT-UDP context IDs under RFC 9298.

Response status codes

Code

Status

Description

200

OK

Tunnel established. UDP datagrams can now flow on the request stream.

400

Bad Request

Malformed target URI or invalid request parameters.

407

Proxy Authentication Required

Authentication failed or account traffic limit reached.

SOCKS5

Oxylabs Residential Proxies support SOCKS5 connections over TCP and UDP.

SOCKS5 connection supports both socks5h:// and socks5://:

socks5h passes the hostname
socks5 passes resolved IP

For a standard SOCKS5 connection, use socks5h:// with your connection string:

socks5h://pr.oxylabs.io:7777

SOCKS5 proxy authentication is not supported by Google Chrome. Use Mozilla Firefox or HTTP clients instead.
Certain target websites can identify proxy traffic using SOCKS5. If you encounter connection errors, switch to HTTP or HTTPS.
SOCKS5 connections do not support country-specific entry points (e.g. de-pr.oxylabs.io) and localization must be used through username-based location parameters.
Google is a restricted target to use with UDP connection.

Code examples

curl -x socks5h://pr.oxylabs.io:7777 -U "customer-USERNAME-cc-FR:PASSWORD" https://ip.oxylabs.io/location

import requests

proxies = {
    'http': 'socks5h://customer-USERNAME-cc-FR:PASSWORD@pr.oxylabs.io:7777',
    'https': 'socks5h://customer-USERNAME-cc-FR:PASSWORD@pr.oxylabs.io:7777'
}

response = requests.get('https://ip.oxylabs.io/location', proxies=proxies)
print(response.text)

<?php
$username = 'USERNAME';
$password = 'PASSWORD';
$country = 'FR';
$proxy = 'pr.oxylabs.io:7777';

$query = curl_init('https://ip.oxylabs.io/location');
curl_setopt($query, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($query, CURLOPT_PROXY, "socks5h://$proxy");
curl_setopt($query, CURLOPT_PROXYUSERPWD, "customer-$username-cc-$country:$password");
$output = curl_exec($query);
curl_close($query);
echo $output;
?>

Allowed proxy target ports

The default configuration of proxy ports includes 80 and 443, designed to accommodate standard HTTP and HTTPS protocols. HTTP/3 (MASQUE) operates on UDP port 50000.

Protocol

Transport

Port

HTTP

TCP

80

HTTPS

TCP

443

HTTP/3 (MASQUE)

UDP

50000

To access other ports, it is necessary to undergo compliance verification, please contact our support.

PreviousSession Control & IP Rotation

NextAdvanced Filters

Last updated 1 day ago

Was this helpful?