curl reaches the API but Claude Code says Connection refused
Check Is ANTHROPIC_BASE_URL set in the shell or in a settings file?
Fix Remove it, or point it at a gateway that is running, then start Claude Code from a new terminal.
What each connection message means, and the order to check things in.
| Item | What it means | Check first |
|---|---|---|
| Connection refused (ConnectionRefused, ECONNREFUSED) | Something refused the connection: a firewall, a proxy, or an address that is not listening | A leftover ANTHROPIC_BASE_URL, then the firewall and proxy |
| Can't reach the API server (ENOTFOUND) | The name did not resolve | Internet and DNS |
| No internet route (EHOSTUNREACH) | There is no route to the host | Network and VPN |
| Couldn't connect through your proxy (ERR_PROXY_TUNNEL) | The proxy refused the tunnel | The proxy login, and whether it allows api.anthropic.com |
| Connection dropped (ECONNRESET) | The connection was reset after it opened | Proxy or gateway in the path, VPN, unstable network |
| Request timed out | No answer in time | Internet and proxy settings |
| SSL certificate verification failed | A proxy or appliance re-signs traffic with a certificate Claude Code does not trust | NODE_EXTRA_CA_CERTS |
Source: Claude Code docs, error reference, read on 15 November 2026. The docs show a timeout as Request timed out; treat ETIMEDOUT the same way.
1. The network cannot reach api.anthropic.com. No internet, a VPN that blocks the host, or a firewall in between. Claude Code retries transient failures up to 10 times with exponential backoff, so by the time you see the error it has already tried.
2. A required proxy is not set, or is set wrong. Claude Code reads HTTPS_PROXY and HTTP_PROXY, takes the login inside the URL, and does not support SOCKS. An address without the http:// scheme stops the launch with an error that names the variable.
3. A leftover ANTHROPIC_BASE_URL. When it is set, Claude Code sends model requests to that address instead of api.anthropic.com, so a value pointing at a local gateway that is no longer running gives Connection refused even though curl reaches the API.
# 1. Can this shell reach the API host at all? (PowerShell: use curl.exe)
curl -I https://api.anthropic.com
# 2. Through your proxy (replace with your own proxy URL)
curl -x http://LOGIN:PASSWORD@HOST:PORT -I https://api.anthropic.com
# 3. Is a leftover gateway address set? (PowerShell: echo $env:ANTHROPIC_BASE_URL)
echo $ANTHROPIC_BASE_URL
# 4. Set the proxy before you start Claude Code, then check the Proxy row in /status
export HTTPS_PROXY=http://LOGIN:PASSWORD@HOST:PORT
claudeExample only: replace LOGIN, PASSWORD, HOST and PORT with your own proxy details, and use an HTTP proxy because Claude Code does not support SOCKS.
Find it in the table above. The code in brackets tells you whether it is DNS, refusal, a reset, a proxy tunnel or a timeout.
Run curl -I https://api.anthropic.com where you start claude. If it fails, the problem is the network, a VPN or a firewall, not Claude Code.
Expected result An HTTP status line from the API host.
Check ANTHROPIC_BASE_URL in the shell and in the env block of your settings files. On Linux and WSL check /etc/resolv.conf for an unreachable nameserver; on macOS check for a stale VPN tunnel; quit Docker or similar tools to rule them out.
Set HTTPS_PROXY=http://USERNAME:PASSWORD@HOST:PORT before starting claude, or in the env block of ~/.claude/settings.json so background agents get it. Run /status and read the Proxy row.
Point NODE_EXTRA_CA_CERTS at your organization's CA bundle. Do not set NODE_TLS_REJECT_UNAUTHORIZED=0, which turns certificate checking off.
At first-run setup the check of api.anthropic.com and platform.claude.com gives each probe 10 seconds. If your network is open and it keeps failing, Claude Code may not be available in your country, so read the supported countries first.
Check Is ANTHROPIC_BASE_URL set in the shell or in a settings file?
Fix Remove it, or point it at a gateway that is running, then start Claude Code from a new terminal.
Check Is the login right, and does the proxy allow api.anthropic.com?
Fix Copy USERNAME and PASSWORD from My assets again and test with curl -x before starting claude.
Stop when If the test fails too, open a ticket with the order number.
Check Is the proxy URL socks5://?
Fix Claude Code does not support SOCKS: use an HTTP proxy.
Check Is the variable only exported in the shell?
Fix Put it in the env block of ~/.claude/settings.json.
Check Is ANTHROPIC_BASE_URL pointing at an LLM gateway?
Fix Test the gateway route with a direct request and check what it accepts; the docs name tool search fields as one thing to check.
Stop when If it only fails through the gateway, the gateway is the thing to fix.
If your network needs a proxy to reach the API, give Claude Code an HTTP one: open the ISP for AI subscriptions page for Claude (or the static ISP page), choose HTTP as the protocol, generate it, and copy HOST, PORT, USERNAME and PASSWORD from My assets into HTTPS_PROXY. Then run /status and the curl test above.
A proxy changes only the network exit. Anthropic's rules on supported countries and regions still apply to you, so choose an exit in a country where Claude is available. There is no free trial. A failed asset is fixed by reissuing it after a ticket with the order number.
The TCP connection from Claude Code to the API failed or never completed. The code in brackets names the kind of failure, such as ECONNREFUSED, ENOTFOUND, ECONNRESET or a timeout.
The message shows it as Connection dropped: the connection was reset after it opened. Check any proxy or gateway in the path, a VPN and the stability of the network.
No. The documentation says Claude Code does not support SOCKS proxies. Use an HTTP proxy in HTTPS_PROXY.
Look for a leftover ANTHROPIC_BASE_URL, a stale VPN tunnel on macOS, an unreachable nameserver on Linux or WSL, and for variables that are set in the shell but not in settings.json.
Yes, transient failures are retried up to 10 times with exponential backoff. Certificate failures are not retried, because retrying cannot fix them.
Official documentation · Confirmed on:
Read on 15 November 2026: the Unable to connect to API entry lists the messages with the codes ConnectionRefused or ECONNREFUSED, ENOTFOUND, EHOSTUNREACH, ERR_PROXY_TUNNEL, ECONNRESET (Connection dropped) and Request timed out; common causes are no internet access, a VPN that blocks api.anthropic.com and a required corporate proxy that is not configured; the checks are curl -I https://api.anthropic.com from the same shell, HTTPS_PROXY, ANTHROPIC_BASE_URL left over from a gateway that is no longer running, an unreachable nameserver in /etc/resolv.conf on Linux and WSL, a stale VPN tunnel on macOS, and container runtimes; certificate failures are not retried and are fixed with NODE_EXTRA_CA_CERTS, not NODE_TLS_REJECT_UNAUTHORIZED=0; transient failures are retried up to 10 times with exponential backoff; the first-run check of api.anthropic.com and platform.claude.com gives each probe 10 seconds, and if the network is open and it still fails Claude Code may not be available in your country.
Official documentation · Confirmed on:
Read on 15 November 2026: Claude Code reads HTTPS_PROXY, HTTP_PROXY and NO_PROXY; a proxy with basic authentication takes the login in the URL (http://username:password@host:port); Claude Code does not support SOCKS proxies; a proxy URL it cannot parse, such as one missing the http:// scheme, stops the launch with an error naming the variable; /status shows the active proxy; settings in the shell are read once at startup; background agents should get the variables from the env block of ~/.claude/settings.json; the page lists the hosts to allow, including api.anthropic.com, claude.ai and platform.claude.com.
Product observation · Confirmed on:
Product facts file of the site, checked 15 November 2026: gateway ports HTTP 2222 and SOCKS5 3333; each static IP has one protocol chosen at purchase; HTTP or SOCKS5 for ISP for AI subscriptions; a failed asset is reissued after a ticket with the order number; no free trial.
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.