Postman proxy settings: from blocked calls to usable data
A collection that returns 200 on a home laptop and 403 from the office network is not a code problem. Postman sends every call from whatever address the machine happens to hold, and protected endpoints judge that address before they ever read the body. Routing the same collection through a carrier IP turns most of those refusals into normal responses, which means fewer hours spent proving that the payload was fine all along.
Two different features share a name here, and confusing them costs an evening. The Postman proxy for capturing requests listens locally and records traffic from a device or browser; the upstream proxy is what sends outgoing calls through a different IP. Only the second one changes what the target server sees, so that is where everything below applies.
Where the proxy configuration actually lives
Open the app settings, switch to the Proxy tab, and leave the default option that inherits the operating system route switched off. Custom configuration exposes four things that matter: the proxy type toggles for HTTP and HTTPS, the server address, the port, and the switch that enables login and password. Fill them in once and every request in every collection follows the same path — no per-request rewriting, no forgotten endpoint leaking your real address.
| Field | What to enter | What it buys you |
|---|
| Proxy type | HTTP and HTTPS both enabled | Secure and plain endpoints travel the same route, so results stay comparable |
| Proxy server / port | Host and port from the dashboard | Requests leave from a carrier IP instead of your own connection |
| Proxy auth | Login and password | Works from any network, including a laptop that changes Wi-Fi twice a day |
| SSL verification (General) | Off if handshakes fail | Ends the false "self-signed certificate" hunt in minutes |
One limitation is worth knowing before purchase: the built-in fields accept HTTP and HTTPS only, so SOCKS5 stays unused inside the app. Credentials in the login:password format cover Postman, while the same port still serves SOCKS5 to an antidetect browser when work moves from API calls to account management. IP whitelisting is the alternative when a fixed office address makes typing credentials into a shared workspace a bad idea.
Pro-tip: make the first call of every run a request to an IP information endpoint and save the answer into an environment variable. The run log then shows which address served each batch, and a silent fallback to your own connection stops being invisible.
Global route or app-level route
The postman proxy settings screen is deliberately app-scoped, and that is an advantage. Environment variables HTTP_PROXY and HTTPS_PROXY are read by Newman, so a collection that passes on a desktop keeps passing in CI without pipeline edits. A system-wide route, by contrast, drags updates, telemetry, and every other application onto the same port, burning session time on traffic nobody asked for.
Why the IP type decides your success rate
Scoring services rate a hosting address around 75–100 out of 100 and a carrier address closer to 0–15, and that single number often stands between a clean response and a captcha wall. Mobile addresses also sit behind carrier NAT, where hundreds of real subscribers share one IP, so platforms reply to suspicious traffic with a soft limit rather than a hard ban. Targets that gave residential pools under 80% success frequently run at 95–99% from a mobile ASN — same script, far smaller retry bill.
Geo accuracy matters just as much when the endpoint returns localized information. Choosing country, city, and carrier means the website under test answers with the pricing, language, and inventory a real subscriber in that region would see, instead of a fallback page that quietly corrupts your dataset.
Sessions, rotation, and long collection runs
Authorization flows need one address for the entire sequence: a token issued on one IP and replayed from another is the fastest way to invalidate it. Bulk pagination is the opposite case, where a fresh address per batch keeps rate limits away from a 5,000-request run. Both patterns live on the same port when rotation is controllable.
| Task in Postman | Session mode | Plan |
|---|
| Login, token reuse, stateful sandbox | Sticky session | Regular |
| Paginated collection run | Rotation by link between iterations | Regular |
| Overnight monitoring run | Timer rotation | Regular |
| Occasional manual request checks | Automatic change every 2–5 minutes | Lite |
Lite shares one device between up to five users and rotates on its own schedule, which fits quick manual checks and keeps the entry cost down. Regular hands over the whole device for the rental period: sticky sessions, change by link, change by timer, device reboot, and priority support. For a scripted run that must survive four hours unattended, that control is the difference between one clean dataset and three restarts.
Paying for ports, not gigabytes
Billing runs per port for 1, 7, or 30 days, with a 24-hour minimum period and no per-gigabyte metering on either plan. Unlimited traffic here means no volume invoice — not unlimited speed — so a weekend load test costs the same whether the collection moves a few megabytes of JSON or a few gigabytes. Budgeting becomes arithmetic instead of guesswork.
Cashback arrives as promo credits on the internal balance once a paid rental ends, and refunds follow the published refund and replacement policy, where a technical fault is answered with a replacement port first. The site widget also hands out one free server proxy, which is enough to confirm the Proxy tab is filled in correctly; mobile ports carry the risky work and have no free trial. Support runs around the clock with a four-hour target for the first reply, so a broken port does not idle until morning.
Mistakes that cost a night of debugging
- Locale mismatch: a Berlin port paired with a US timezone and currency header is an instant red flag on any protected endpoint.
- One port reused for several accounts on the same website, which links them together and undoes the isolation you paid for.
- Skipping verification: confirm the address type and fraud score on whoer.net or ipqualityscore.com before rewriting working code.
- Leaving the system route enabled alongside custom configuration, which makes the outbound path unpredictable between restarts.
- Expecting the network layer to hide a browser fingerprint — API work is fine, but account work needs an antidetect profile per port.
Written down properly, postman proxy settings are a five-field job that stops mattering the moment they are correct. What keeps mattering is the address behind them: a mobile port carries the trust that hosting ranges lost years ago, and it turns retry loops back into finished runs.