Category: Access and Usage | Updated: 2026-09-14

Extracting the proxy is just the first step. This page explains 'where to fill in, how to fill it in, and how to confirm it works' according to different scenarios, and the code snippets can be copied directly.

On this page:

• One-minute quick check: three ways to write
• Command Line Access
• Code Integration
• Client and system integration
• Conversation and Timeliness
• Protocol and DNS Considerations
• How to perform self-check after connection
• Frequently Asked Questions

The previous chapter talked about 'how to extract proxies,' and this page discusses 'how to plug them in after obtaining them.' There are four types of scenarios: command line, code, system, and antidetect browser, and each section provides code that can be copied directly; in the examples, replace subaccount:subaccountpassword and us.duckip.net:1000 with the line generated in your dashboard.

• HTTP / SOCKS5 · Username/password authentication or IP whitelist · Sticky sessions supported · Direct import into antidetect browsers

① Select access method → ② Copy one corresponding writing method → ③ First perform a connectivity self-check → ④ Spread out in batches again

Remember three things before starting ① Duckip proxies only support HTTP and SOCKS5; ② The _area-XX_life-N_session-XXX in the username is an optional parameter segment and will be used to assemble the username. Do not omit any segments when copying, and do not change the separators to other characters; ③ The hostname and port should follow the “copy” result from the dashboard — us.duckip.net:1000 (dynamic) / as.duckip.net:2000 (static) in this article are just examples. Prefixes may vary depending on region and product line, so please do not copy them directly.

One-Minute Reference: Three Formats for the Same Proxy

The dashboard 'Batch Generate' provides a four-part format (Host:Port:Username:Password). Different clients require different formats, convert according to the table below:

What do you have on hand	How it looks filled in the client	Applicable scenarios
Host:Port:Username:Password	us.duckip.net:1000:Sub-account:Password	Fingerprint browser 'Paste Import', proxy manager batch import, CMD batch check
username:password@host:port	http://subaccount:password@us.duckip.net:1000	Proxy parameters in curl/code (URL format), environment variable http_proxy
Only Host:Port	http://us.duckip.net:1000	Local IP has been added to the whitelist (no username or password required)

The Relationship of Types ① and ② The four-part format is the expanded form of a URL: host:port:username:password → http://username:password@host:port. When manually converting, it is easiest to forget the http:// prefix or to write the underscore in the username or the session- prefix incorrectly.

Command Line Access

cURL: The Most Common Three Lines

First, confirm whether the connection is working before discussing business. The following three items correspond to username/password authentication, whitelisting, and SOCKS5, respectively.

# Username/password authentication: host + port + sub-account + password (the URL places 'username:password' before @)
curl -sS -m 20 -x "http://subaccount:subaccount_password@us.duckip.net:1000" https://api.ip.cc/

# Only look at the status code and time taken, do not print the body (-o /dev/null means discard the body)
curl -s -o /dev/null -w "HTTP:%{http_code} time:%{time_total}s\n" -m 20 \
  -x "http://subaccount:subaccount_password@us.duckip.net:1000" https://api.ip.cc/

# Whitelist mode: If the local IP is already in the whitelist, no username or password is required
curl -sS -m 20 -x "http://us.duckip.net:1000" https://api.ip.cc/

# Static residential proxy (port 2000) uses the same format, just change the host and port
curl -sS -m 20 -x "http://subaccount:subaccount_password@as.duckip.net:2000" https://api.ip.cc/

# SOCKS5: Use socks5h:// to let the domain be resolved on the proxy side (recommended)
curl -sS -m 20 -x "socks5h://subaccount:subaccount_password@us.duckip.net:1000" https://api.ip.cc/

# Equivalent writing: provide the proxy address and credentials separately (better for concatenation in some scripts)
curl -sS -m 20 --socks5-hostname us.duckip.net:1000 \
  --proxy-user "subaccount:subaccount_password" https://api.ip.cc/

# Sticky Sessions: Write the session into the username, reuse the same outbound IP for the same session within its validity period
curl -sS -m 20 -x "http://subaccount_area-US_life-10_session-abc123:subaccount_password@us.duckip.net:1000" https://api.ip.cc/

# Change IP with each request: just omit the session part
curl -sS -m 20 -x "http://subaccount:subaccount_password@us.duckip.net:1000" https://api.ip.cc/

Do not omit the http:// prefix Directly giving the four-part format to -x will report curl: (5) Unsupported proxy syntax ... Port number was not a decimal number. The correct approach is to first split it by :, then combine it into http://username:password@host:port; see the overview and connectivity check for batch scripts.

Why use socks5h for SOCKS5 socks5 will resolve domain names on the local machine. If a proxy software with fake-ip is running locally (for example, Clash's 198.18.0.0/16), the resolution result will be hijacked into a fake IP; socks5h hands the domain name to the proxy for resolution, making the result closer to the real exit.

Environment Variables: Set Once, Benefit Multiple Tools

git, pip, npm, wget, and some SDKs all read http_proxy / https_proxy. Suitable for temporarily switching to a proxy for a period of work.

# Environment variable method: temporary (effective only within the current terminal window) — most command-line tools will automatically read it
export http_proxy="http://subaccount:subaccount_password@us.duckip.net:1000"
export https_proxy="$http_proxy"
export all_proxy="socks5h://subaccount:subaccount_password@us.duckip.net:1000"   # Optional, SOCKS5 scenario

# Windows CMD / PowerShell (Temporary)
set http_proxy=http://subaccount:subaccount_password@us.duckip.net:1000
set https_proxy=%http_proxy%
# In PowerShell, change to: $env:http_proxy="http://subaccount:subaccount_password@us.duckip.net:1000"

# git use a proxy (only effective for this command, not written to the global configuration)
git -c http.proxy=http://subaccount:subaccount_password@us.duckip.net:1000 clone https://github.com/user/repository.git

# pip use proxy
pip install --proxy http://subaccount:subaccount_password@us.duckip.net:1000 package_name

# npm using a proxy (written into project or global configuration)
npm config set proxy http://subaccount:subaccount_password@us.duckip.net:1000
npm config set https-proxy http://subaccount:subaccount_password@us.duckip.net:1000

# If you want to restore after use, clear the proxy settings
git config --unset http.proxy ; npm config delete proxy ; npm config delete https-proxy

Code Integration

Copy the corresponding segment according to your tech stack. All segments follow the same set of parameters: proxy URL, connection timeout, and print errors on failure.

import requests

PROXY = "http://subaccount:subaccount_password@us.duckip.net:1000"
proxies = {"http": PROXY, "https": PROXY}

r = requests.get("https://api.ip.cc/", proxies=proxies, timeout=20)
print(r.status_code, r.json()["ip"])

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

PROXY = "http://subaccount:subaccount_password@us.duckip.net:1000"

s = requests.Session()                     # Reuse connections, batch requests are faster
s.proxies = {"http": PROXY, "https": PROXY}
s.mount("https://", HTTPAdapter(max_retries=Retry(total=2, backoff_factor=0.5)))

for i in range(3):
    r = s.get("https://api.ip.cc/", timeout=20)
    print(i, r.json()["ip"])               # When not using the session segment, each request will change the IP

import httpx

# The proxy parameter of httpx is a single URL (from v0.26 it is proxy=, older versions use proxies=)
with httpx.Client(proxy="http://subaccount:subaccount_password@us.duckip.net:1000", timeout=20) as c:
    r = c.get("https://api.ip.cc/")
    print(r.status_code, r.json()["ip"])

// npm i axios https-proxy-agent
const axios = require("axios");
const { HttpsProxyAgent } = require("https-proxy-agent");

const agent = new HttpsProxyAgent("http://subaccount:subaccount_password@us.duckip.net:1000");

(async () => {
  const r = await axios.get("https://api.ip.cc/", {
    httpsAgent: agent,
    proxy: false,                 // Turn off axios's own proxy handling to avoid duplication
    timeout: 20000,
  });
  console.log(r.status, r.data);
})();

// No dependencies: use native http to send CONNECT, then run https through the tunnel
const http = require("http");
const https = require("https");

function viaProxy(proxyUrl, targetUrl, callback) {
  const p = new URL(proxyUrl);
  const t = new URL(targetUrl);
  const auth = p.username
    ? "Basic " + Buffer.from(
        `${decodeURIComponent(p.username)}:${decodeURIComponent(p.password)}`).toString("base64")
    : null;
  const req = http.request({
    host: p.hostname, port: p.port || 80, method: "CONNECT",
    path: `${t.hostname}:${t.port || 443}`,
    headers: auth ? { "Proxy-Authorization": auth } : {},
    timeout: 20000,
  });
  req.on("connect", (res, socket) => {
    if (res.statusCode !== 200) { socket.destroy(); return callback(new Error("Proxy returned " + res.statusCode)); }
    callback(null, socket, t);
  });
  req.on("error", callback);
  req.end();
}

viaProxy("http://subaccount:subaccount_password@us.duckip.net:1000", "https://api.ip.cc/", (err, socket, t) => {
if (err) return console.error("Failed:", err.message);
  const req = https.request({ host: t.hostname, path: "/", socket, agent: false,
    headers: { Host: t.hostname } }, (res) => {
    let body = "";
    res.on("data", (c) => (body += c));
    res.on("end", () => console.log(res.statusCode, body));
  });
req.on("error", (e) => console.error("Failed:", e.message));
  req.end();
});

package main

import (
	"fmt"
	"io"
	"net/http"
	"net/url"
)

func main() {
	proxyURL, _ := url.Parse("http://subaccount:subaccount_password@us.duckip.net:1000")
	client := &http.Client{Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)}}

	resp, err := client.Get("https://api.ip.cc/")
	if err != nil {
fmt.Println("Request failed:", err)
		return
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(body))
}

import java.net.Authenticator;
import java.net.InetSocketAddress;
import java.net.PasswordAuthentication;
import java.net.ProxySelector;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public class DuckIPProxy {
    public static void main(String[] args) throws Exception {
        String user = "subaccount";
        String pass = "subaccount_password";

// Proxy authentication must go through the Authenticator (the Proxy-Authorization request header is sent to the target site and is invalid for the proxy)
        HttpClient client = HttpClient.newBuilder()
                .proxy(ProxySelector.of(new InetSocketAddress("us.duckip.net", 1000)))
                .authenticator(new Authenticator() {
                    @Override
                    protected PasswordAuthentication getPasswordAuthentication() {
                        if (getRequestorType() == RequestorType.PROXY) {
                            return new PasswordAuthentication(user, pass.toCharArray());
                        }
                        return null;
                    }
                })
                .connectTimeout(Duration.ofSeconds(20))
                .build();

        HttpRequest req = HttpRequest.newBuilder(URI.create("https://api.ip.cc/"))
                .timeout(Duration.ofSeconds(20))
                .GET().build();

        HttpResponse<String> resp = client.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println(resp.statusCode() + " " + resp.body());
    }
}

<?php
$ch = curl_init("https://api.ip.cc/");
curl_setopt_array($ch, [
  CURLOPT_PROXY        => "us.duckip.net:1000",
  CURLOPT_PROXYUSERPWD => "sub-account:sub-account-password",   // You can also directly write it as "sub-account:password@host:port"
  CURLOPT_PROXYTYPE    => CURLPROXY_HTTP,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_TIMEOUT      => 20,
]);
$body = curl_exec($ch);
if ($body === false) {
  echo "Failed: " . curl_error($ch);
} else {
  echo curl_getinfo($ch, CURLINFO_HTTP_CODE) . " " . $body;
}
curl_close($ch);

# Windows PowerShell: Credentials cannot be written in the URL of -Proxy (will cause 407), you need to use -ProxyCredential
$secure = ConvertTo-SecureString "subaccount_password" -AsPlainText -Force
$cred   = New-Object System.Management.Automation.PSCredential("subaccount", $secure)

Invoke-RestMethod -Uri "https://api.ip.cc/" `
  -Proxy "http://us.duckip.net:1000" -ProxyCredential $cred -TimeoutSec 20

Two Common Pitfalls ① When using axios, if both a global proxy and httpsAgent are set at the same time, you need to add proxy: false, otherwise a proxy will be applied twice; ② PowerShell's -Proxy does not recognize the username and password in the URL (actual test will return 407), you must use -ProxyCredential.

Client and System Access

Scene Recommended practice Fingerprint browsers (AdsPower / Bit / Hubstudio / Dolphin, etc.) Directly paste the four-part format or fill in the four fields, select HTTP or SOCKS5 for the protocol; see the field-by-field explanation Overview With each client section Chrome / Edge (Temporary) Startup parameters --proxy-server="http://dashboard-host:port" , example http://us.duckip.net:1000 (Not recommended to keep enabled for a long time on main browsers) Firefox Settings → Network Settings → Manually configure the proxy, fill in the host and port (username and password can be written in the URL or asked in a pop-up) Windows System Proxy Settings → Network & Internet → Proxy → Manual setup, enter the host and port from the dashboard results (example us.duckip.net and 1000 ）； Note that the system proxy is global , remember to turn it off after use Phone / Emulator In Wi-Fi advanced settings, enter the proxy host and port; on Android, if you want SOCKS5, you usually need to use a antidetect browser or proxy app

Why antidetect browsers are prioritized Fingerprint browsers can bind a separate proxy for each environment (one session), achieving 'one environment, one egress IP'; system proxies are global, cannot isolate by environment, and can easily mix the egress IPs of multiple accounts.

Sessions and Timing: How to Control Egress IP Reuse

You can combine parameter segments in the username. The three most commonly used segments are _area-XX (country/city), _life-N (number of minutes to keep the IP), and _session-XXX (session identifier).

Desired Effect	How to Write Username	Description
Change IP for each request	Sub-account (without any parameter segment)	When session is not filled, each request is preferentially allocated a different IP
Use the same IP for a full period	subaccount_life-30_session-abc123	Reuse the same outbound IP for the same session within the life validity period
Specified Region Sticky	subaccount_area-US_life-10_session-abc123	First lock the region, then lock the duration and session
Multi-account isolation	A different session value for each environment	When generating in bulk, different sessions are automatically assigned, and they can be matched directly to each environment

The writing of session must be consistent For the value after session-, please use a combination of letters and numbers, and the same string must be used for the same session (case-sensitive); do not include extra spaces or line breaks when copying.

Optimization Item	How to Understand	Suggestions
Concurrency	The more concurrent requests from the same account, the more likely it is to trigger the target site's risk control	Gradually increase pressure according to business volume and observe failure rates; use different sessions for different accounts
Bandwidth	Unlimited residential proxy selection based on "Bandwidth Concurrency Billing cycle"	First select based on peak demand, add more if insufficient; insufficient bandwidth will manifest as timeout rather than error
Lifetime	Maintain IP usage time, up to 120 minutes	For login operations, 10–30 minutes is enough, no need to max out
Traffic	Dynamic billing based on traffic, static billing based on number of IPs	Enable caching proxy when batch fetching static resources (HTTP only, not supported by Bit Browser)

Four Key Points About Protocols and DNS

Points to Note	Phenomenon	Handling
The protocol only supports HTTP / SOCKS5	Selecting protocols like SOCKS4 / SSH cannot connect	Go back to the client and switch the protocol back to HTTP or SOCKS5
Local DNS hijacking (fake-ip)	When using SOCKS5 with local resolution, you get 198.18.x.x	Switch to socks5h://, or change the protocol to HTTP
The target is an HTTPS site	After writing through the proxy, the browser shows a certificate error	In the case of a caching proxy, install the certificate according to Caching Proxy; a regular proxy does not require a certificate
Unified Standards	Inconsistent judgments between the homepage, help documents, and the client	The real-time display in the dashboard shall prevail; this document is for operational instructions only

How to self-check after access

1. First, look at the direct connection output

• Interface position: Native terminal
  • How to operate: curl -sS https://api.ip.cc/
• Expected Result: Record the direct connection egress IP and country for comparison with proxy exits.

2. Go through the proxy to check once more
   • Interface Location: Same as above

• How to operate: Replace the cURL snippet from the previous section with your proxy parameters and execute it.
  • Expected Result: The returned country_code matches the target region, and asn_type is residential.

3. Fill the proxy into the client
   • Interface Location: Fingerprint browser environment / software proxy settings
   • How to operate: Paste the four-part format, click 'Check Proxy' or open the environment after saving.

• Expected Result: The client passes the check, and the IP found on the page matches the terminal results.

4. Troubleshoot according to the table
   • Interface Location: Quick Troubleshooting Checklist
   • How to operate: Match according to response codes like 407 / 612 / HTTP:000.
   • Expected result: Identify whether it is a credential, whitelist, protocol, or local network issue.

Frequently Asked Questions

Problem	Handling
The same piece of code runs in the terminal but fails in the antidetect browser	The client protocol is most likely set to something other than HTTP/SOCKS5, or the client has cached old settings; switch to HTTP, save, and reopen the environment.
curl shows CONNECT tunnel failed, response 407	The credentials were incorrect (including missing parameter segments) or the account is not effective on that port. Check all four segments and try again.
The returned IP remains unchanged	Either it comes with a fixed session, or it is within the life validity period; changing the session value can change the IP.
Requests occasionally time out	First, lower concurrency and increase timeout to 20–30 seconds, then see if it is the target site's rate limiting.
Java client reports too many authentication attempts	The proxy username or password is incorrect. Java retries 3 times before throwing this exception (not just a simple 407) — check the four pieces of information before retrying; confirm that the credentials are passed in through Authenticator.
Want to switch between multiple plans simultaneously	Billing is done separately by plan under the same main account. Sub-accounts are bound to specific plans and cannot be reused across plans; each plan uses its own set of four pieces of information.

Related Documents username/password authentication Extraction | API Extraction and Code Integration | Parameter Details and Generation Format | Cached Proxy | Quick Troubleshooting Table

---

Previous pageCache Proxy

Next pageProxy Connectivity Checks