Apache HttpClient Knows the Password but Keeps Getting 407

A correct password in the provider does not establish a matching credential for the proxy actually selected. Start with that endpoint's scheme, host and port; a host field usually takes only a hostname or IP, not a full URL.

1. Read the whole authentication exchange. One 407 followed by an accepted retry can be normal. Establish that the final result is still 407 before treating the login as rejected.
2. Compare route and credential scope. Match the actual host/port and other fields defined by the deployed HttpClient 5 AuthScope. A wrong port can leave BasicCredentialsProvider with no suitable entry.
3. Check method and identity. Did the proxy offer the supported method? Did the retry use the expected connection? Does the operator require a domain-qualified account or another documented format?

Use the installed major-version API. An HttpClient 4 authentication-cache recipe does not map unchanged into version 5. Use the operator's account requirements rather than loop through arbitrary username variants.

Preemptive authentication is another deliberate choice. For a compatible scheme it can remove a round trip, but it changes when credentials leave and needs a supported scope. It cannot be the first repair for a mismatched endpoint or unsupported method.

Keep challenged proxy identity, method, scope match and final status in redacted diagnostics. The password and raw credential-bearing traces are unnecessary for that comparison.