Camofox is the Camoufox browser wrapped in a REST server, so an agent can drive it over HTTP. That changes where the proxy goes: not into a launch call in your code, but into the server's environment. It also changes what a proxy means here, because in this server adding one is what switches the location matching on. We read release 1.16.0, published on 14 September 2026, and its issue tracker.
One clarification first, because the names differ by a letter. This page is about the server, jo-inc/camofox-browser. The browser underneath is Camoufox, and it has its own settings and its own page.
The settings
# one endpoint
export PROXY_HOST=GATEWAY_HOST
export PROXY_PORT=GATEWAY_PORT
export PROXY_USERNAME=USER
export PROXY_PASSWORD=PASS
# or a gateway with sessions
export PROXY_STRATEGY=backconnect
export PROXY_BACKCONNECT_HOST=GATEWAY_HOST
export PROXY_BACKCONNECT_PORT=GATEWAY_PORT
export PROXY_PROVIDER=generic
PROXY_PROTOCOL takes http, https, socks4 or socks5, and defaults to plain HTTP. The SOCKS options are new: they were asked for in August 2026 and shipped in the September release, so an older install does not have them. There are also country and state settings for networks that take targeting in the username.
The two strategies are not equivalent
| One endpoint | Gateway | |
|---|---|---|
| How the address changes | next port in your list | new session per launch |
| Rotates sessions | no | yes |
| Launch attempts | 1 | 5 |
| Launch timeout | 60 seconds | 120 seconds |
That difference in attempts matters more than it looks. On the gateway strategy each attempt asks for a brand new session, so an exit address that fails gets replaced on the next try. A port list gets one attempt, with the first port, and no second chance.
The username trap
Set the gateway strategy without naming a provider and the server builds your username in the format of one particular commercial proxy network, complete with that network's session and targeting syntax. On any other line that username is simply wrong, and the gateway will refuse it.
So name the provider. The generic one appends the session to the username you already have, which is what most gateways expect:
USER-sess-a1b2c3d4e5f6
If your line wants something else, the server has a registration hook for adding your own provider, so you can teach it a different username shape without forking it.
What a proxy switches on
The whole identity module is four lines. With a proxy the server grants the geolocation permission and steps back, letting the browser derive timezone, locale and coordinates from the exit address. Without a proxy it applies only what you configured, and it insists on a pair: set the locale and the timezone together or neither.
That pairing is recent, and it comes from a good bug report. Until the September release a session without a proxy reported a Los Angeles timezone, an American locale and San Francisco coordinates, no matter where the machine actually was. The reporter's words are the best summary of why this page exists: "the browser's reported location contradicts its own network origin. This is a strong automation signal and defeats the purpose of an anti-detection browser." The release that fixed it is called "Stop claiming a location you do not have".
The ten second cap
Here is the part that is not in any release note. The location step is wrapped in a ten second timeout. If it fails, or simply takes longer, the server does not stop and does not fail your request. It launches the browser again with the matching turned off, and writes one warning line.
Your session then runs behind your proxy, with the browser's own default identity. The exact mismatch the release was named for, arriving quietly through the back door.
How much room is ten seconds? The lookup asks public address services through your proxy. We requested all six of them from our own server: every one answered, the slowest in 0.223 seconds, and asking all six in sequence cost about 0.75 seconds. So on a healthy line there is plenty of room. The cap bites when requests hang instead of answering, which is exactly what a saturated or unstable line does to everything it carries.
Two practical habits follow. Watch the log for that warning rather than assuming the match happened. And treat lookup latency as a reason to care about line quality, not just about exit addresses.
Which proxy type fits it?
Residential, because the reason for this server is sites that refuse a hosting address. In our paired test a residential address changed 4 of 13 answers, while four sites refused both. The server changes what the browser looks like; only the line changes where it comes from.
Then match the strategy to the product. A sticky port fits the one endpoint mode: give the server a port list and each browser keeps its address. A gateway with sessions fits the backconnect mode, and gets you the five launch attempts, which is worth having when a bad exit can cost you the location match. Either way the address should hold for the life of that browser, because the matching happens once at launch. Write a retry anyway, since a sticky address can change early when its device leaves the network.
The residential proxies page lists the plans, and the plan API manages allowed addresses from code.
What breaks
- The gateway rejects your username. The default provider format belongs to another network. Set the generic one.
- The browser runs without the location match. The lookup overran ten seconds. Check the warning in the log and the health of the line.
- A single endpoint fails to launch. That strategy gets one attempt. A gateway gets five.
- Every request goes through one address. The address is picked when the browser launches. Choosing one per request is an open proposal, not a feature.
- A navigation timeout took the whole session down. That was reported in August 2026 and narrowed to the case where a proxy can actually rotate.
What this page does not cover
We read the server and its release notes as text and did not run it, so we have not seen the fallback warning in a live log and did not time a launch. We did not test the SOCKS options against it. Our timing of the address services was made from our own server without a proxy, so through a proxy every one of those requests is slower: treat our numbers as the floor, not the expected time. The proxy surface here moved twice in the last month, so we will read it again at the next release, by 20 October 2026.
Where to go from here
Proxies for Camoufox covers the browser underneath, where the same location lookup is a Python argument and has its own traps. Proxies for CloakBrowser is the Chromium equivalent, with a different answer to the login. Proxies for Obscura is the engine that does no location matching at all and leaves the clock to you.
Sources
- The proxy settings table and the identity settings (README.md). The two strategies, the session username and the provider hook (lib/proxy.js). The location switch, the ten second cap and the fallback, and the launch attempts (server.js). The identity module (lib/browser-identity.js). jo-inc/camofox-browser, release v1.16.0 of 14 September 2026, read 20 September 2026.
- The release notes for v1.16.0, "Stop claiming a location you do not have".
- Issue 10667 on the San Francisco identity, issue 9333 on SOCKS support, pull request 3660 on a proxy per request, issue 9820 on a navigation timeout. Camofox issue tracker, read 20 September 2026.
- The address services the lookup uses (pythonlib/camoufox/utils.py). daijro/camoufox, release 0.5.6.
- Our own measurement of 20 September 2026: two runs against all six address services from our server. Raw output is kept in the research folder of this page.
- Our paired address test of 19 September 2026. Raw output is kept in the research folder of our OpenClaw page.
- Plans, allowed addresses and sticky sessions. HProxy documentation, hproxy.com/docs, 20 September 2026.
