Match the Correct macOS Proxy Credential in Keychain

security find-internet-password -s proxy.example.internal -a alex -P 8080

This narrows an internet-password search without requesting the secret. Replace the example server, account and port. Do not add -g or -w merely to inspect matching attributes: those options reveal password material.

Match the item to the failing connection. Check hostname versus alias, port, domain-qualified account, proxy-specific protocol and authentication type. A hostname alone may match a different credential. Apple's tool supports these selectors and an explicit keychain argument.

Then identify the process's keychain context. A user's interactive lookup does not establish that a system service has the same search list, unlock state or access rights.

Inspect the attributes in Keychain Access or narrow the command before removing a stale item. delete-internet-password accepts the relevant matching fields too; deleting solely by server can target the wrong account or port.

A challenge-response proxy can use stored credentials to calculate a new response, so a challenge does not inherently require retyping a password. Repeated prompts can mean another item, an inaccessible keychain, unsupported authentication or a different effective proxy. Once that distinction is clear, update the specific credential and intended process access rather than allowing every application to read it.