proxyConfiguration cannot be honoured when an Actor delegates fetching to an external worker.
Our published Actors are thin bridges: the Actor validates input and pushes results, while the scraping itself runs on our own infrastructure. When a user enables proxyConfiguration on a run, the Actor is handed a proxy URL on Apify's private network:
http://groups-RESIDENTIAL:apify_actor_run_proxy_…@10.0.35.0:8011
That address is not routable from outside the run container, so forwarding it to our worker makes every navigation fail at the network layer (Chromium's network-error page, no HTTP response at all).
Using the same run-scoped credentials against the documented external endpoint returns 403:
$ curl -x "http://groups-RESIDENTIAL:$PW@proxy.apify.com:8000" http://api.ipify.org
HTTP/1.1 403 Forbidden
x-apify-proxy-error: true
The "Proxy external access" feature isn't enabled for your account.
Please upgrade your plan or contact support@apify.com
DNS and TCP to proxy.apify.com:8000 are fine (18.208.102.16, 35.171.134.41), so this is authorization, not connectivity.
What the docs currently say
Proxy → Usage documents external connection as a plan-gated feature ("To connect to Apify Proxy from outside the Apify platform, you need a paid Apify plan") and notes that an Actor using proxy.apify.com is itself billed as external transfer, with the advice to use APIFY_PROXY_HOSTNAME / APIFY_PROXY_PORT / APIFY_PROXY_PASSWORD instead.
Both of those assume the fetching happens inside the run. Neither covers the case where an Actor legitimately performs its requests elsewhere, which leaves proxyConfiguration in such an Actor's input schema advertising something the Actor cannot deliver.
Ask
Two things, either of which would resolve it:
-
Docs: state explicitly whether an Actor may forward the run's proxy credentials to an external fetcher, and if not, document the supported way to honour a user's proxyConfiguration when the requests do not originate inside the run container. Right now this has to be discovered by watching every request fail.
-
Platform: in summary — a run should hand me a single-use proxy link that I can use only for that run. The user has already paid for proxy usage on that run, so scoping those same apify_actor_run_proxy_… credentials to work from outside the platform for the lifetime of that run (and no longer) would let external fetchers honour proxyConfiguration without opening general external proxy access on the account.
Account for reference: myagizm, plan FREE.
proxyConfigurationcannot be honoured when an Actor delegates fetching to an external worker.Our published Actors are thin bridges: the Actor validates input and pushes results, while the scraping itself runs on our own infrastructure. When a user enables
proxyConfigurationon a run, the Actor is handed a proxy URL on Apify's private network:That address is not routable from outside the run container, so forwarding it to our worker makes every navigation fail at the network layer (Chromium's network-error page, no HTTP response at all).
Using the same run-scoped credentials against the documented external endpoint returns 403:
DNS and TCP to
proxy.apify.com:8000are fine (18.208.102.16,35.171.134.41), so this is authorization, not connectivity.What the docs currently say
Proxy → Usage documents external connection as a plan-gated feature ("To connect to Apify Proxy from outside the Apify platform, you need a paid Apify plan") and notes that an Actor using
proxy.apify.comis itself billed as external transfer, with the advice to useAPIFY_PROXY_HOSTNAME/APIFY_PROXY_PORT/APIFY_PROXY_PASSWORDinstead.Both of those assume the fetching happens inside the run. Neither covers the case where an Actor legitimately performs its requests elsewhere, which leaves
proxyConfigurationin such an Actor's input schema advertising something the Actor cannot deliver.Ask
Two things, either of which would resolve it:
Docs: state explicitly whether an Actor may forward the run's proxy credentials to an external fetcher, and if not, document the supported way to honour a user's
proxyConfigurationwhen the requests do not originate inside the run container. Right now this has to be discovered by watching every request fail.Platform: in summary — a run should hand me a single-use proxy link that I can use only for that run. The user has already paid for proxy usage on that run, so scoping those same
apify_actor_run_proxy_…credentials to work from outside the platform for the lifetime of that run (and no longer) would let external fetchers honourproxyConfigurationwithout opening general external proxy access on the account.Account for reference:
myagizm, planFREE.