Skip to content

Proxies for Codex CLI: Setup Guide and Common Mistakes

OpenAI Codex CLI is a terminal tool for working with code that sends requests to OpenAI. If you work from a network that requires a proxy, Codex CLI can be pointed at it through environment variables. This guide covers the variables, permanent setup, checking the exit IP and common errors.

Get a static ISP IP
Pricing

Key Environment Variables for Proxies

Command-line tools usually read standard proxy-related environment variables; check the documentation for your version of Codex CLI to see which ones it reads. In practice, two variables are enough: HTTPS_PROXY and NO_PROXY.

HTTPS_PROXY specifies the proxy address for HTTPS requests (this is the protocol the OpenAI API uses). The value format is http://host:port. Codex CLI does not support SOCKS5 proxies, so use an HTTP asset (port 2222 on Proxy302). If the proxy requires authentication, the username and password are embedded directly in the URL: http://username:password@host:port.

HTTP_PROXY is used for regular HTTP requests. In most cases, a single HTTPS_PROXY is sufficient, but if both variables are set, each is applied to its own type of request.

ALL_PROXY acts as a universal fallback: if the variable for a specific protocol is not set, ALL_PROXY is used instead. This is convenient when you have a single proxy for all traffic.

NO_PROXY (or no_proxy) is a list of hosts and domains that should be connected to directly, without the proxy. Default values: localhost,127.0.0.1. If you have internal services or corporate network domains, add them to this list separated by commas.

Setup on macOS and Linux

For a temporary setup in the current terminal session, use the export command:

Setup on macOS and Linux: example

export HTTPS_PROXY="http://username:password@proxy-host:port"
export NO_PROXY="localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

Setup on macOS and Linux, continued

To make the variables permanent, add the export lines to your shell's profile file. For Bash, this is ~/.bash_profile or ~/.bashrc; for Zsh, it is ~/.zshrc. After saving the file, restart the terminal or run source ~/.bashrc.

You can verify that the variables are set with the command env | grep -i proxy.

Setup on Windows PowerShell

In PowerShell, the current session uses the $env: syntax:

Setup on Windows PowerShell: example

$env:HTTPS_PROXY = "http://username:password@proxy-host:port"
$env:NO_PROXY = "localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

Permanent setup on Windows with setx

For permanent setup, use the setx command, which writes the variables to the user registry:

Permanent setup on Windows with setx: example

setx HTTPS_PROXY "http://username:password@proxy-host:port"
setx NO_PROXY "localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

After setx: restart and system-wide variables

After running setx, restart PowerShell for the changes to take effect. For system-level variables (available to all users), run PowerShell as administrator and use [System.Environment]::SetEnvironmentVariable().

Checking the Exit Country Before You Start

Before sending requests, check which IP address and country the proxy actually gives you, so you know traffic goes through it. The simplest way is a request through the proxy to any IP geolocation service:

Checking the Exit Country Before You Start: example

curl -x "http://username:password@proxy-host:port" https://ipinfo.io/json

Example only: replace the placeholder values with your own.

Checking the Exit Country Before You Start, continued

In the response, the ip field is the exit IP that OpenAI sees and the country field is its country. If the address is not the one you expect, traffic is not going through the proxy: check the variables again.

Which countries are supported is detailed in the guide to countries where ChatGPT, Claude, and Gemini work.

Why the Exit Country Matters for the OpenAI API

OpenAI publishes a list of countries and territories where its API operates. Requests coming from a non-supported region receive a response with code 403 and the error text "Country, region, or territory not supported".

A proxy only changes the network address visible to the service. The platform itself makes the access decision based on the IP address and other factors, and a proxy does not change OpenAI's terms. OpenAI warns that using its services from outside the supported list may get the account blocked or suspended. If you sign in with a ChatGPT account, ChatGPT's supported countries apply; with an API key, the OpenAI API list applies.

For Codex CLI on Proxy302, use an HTTP IP on port 2222; the host, username and password are shown in My assets.

Proxy URL Authentication

If the proxy requires a username and password, pass them directly in the URL of the environment variable:

Proxy URL Authentication: example

HTTPS_PROXY=http://user:password@host:port

Example only: replace the placeholder values with your own.

Proxy URL Authentication, continued

A password may contain special characters (@, :, /, ?, #, %), which have meaning in a URL. They must be escaped using URL encoding (percent-encoding): @ becomes %40, : becomes %3A, / becomes %2F, and so on. For example, if the password is my@pass:123, it should look like my%40pass%3A123 in the URL.

Common Mistakes and Fixes

Error 407 Proxy Authentication Required. The proxy received the request but did not accept the credentials. Check the correctness of the username and password in the URL, and make sure special characters are escaped. If the problem persists, ask your proxy administrator which type of authentication it requires.

Certificate errors. If a corporate proxy re-signs TLS, point CODEX_CA_CERTIFICATE at a PEM file with the company root CA before running codex login (Codex falls back to SSL_CERT_FILE when it is unset).

Timeouts. If requests hang and do not complete, the proxy is likely not configured or the address is incorrect. Check the variables with the command env | grep -i proxy, make sure the URL includes a scheme (http://), and that the port and host are accessible.

Error "Country, region, or territory not supported". A 403 means OpenAI does not support the region the request comes from; a proxy does not change that. OpenAI warns that using its services from outside the supported list may get the account blocked or suspended.

Full setup for the OpenAI API is on the OpenAI API proxies page. Claude Code works the same way; see the Claude Code proxy setup guide.

How do I make proxy variables permanent on macOS?

Add the lines export HTTPS_PROXY=... and export NO_PROXY=... to the file ~/.zshrc (macOS Catalina and newer) or ~/.bash_profile, then restart the terminal.

Can I use SOCKS5 with Codex CLI?

No. Codex CLI accepts only HTTP proxies (http://) in HTTPS_PROXY and ALL_PROXY; buy the IP with the HTTP protocol (port 2222).

Why does Codex CLI not see proxy variables in VS Code?

The extension starts Codex with VS Code's own environment. If you set the variables after VS Code was opened, quit and reopen it fully, or launch it from a terminal where the variables are set (code .). On Windows, set them permanently with setx and restart VS Code.

Do I need to add the proxy to the OpenAI IP allowlist?

Only if your organization has an IP allowlist enabled in OpenAI. Then add the proxy's exit IP (the one https://ipinfo.io/json shows through the proxy), not the proxy host; this needs a static IP, because a rotating exit changes.

How to do it with Proxy302

A static ISP lease fits this routine: the IP stays fixed while the lease runs and does not rotate, so one address stays with one account or one tool. The page on OpenAI API proxies has the preset and the full setup, and the static ISP page describes the product.

How to do it with Proxy302: steps

  1. Step 1

    Open the static ISP page, choose the country, the term and the quantity, and the protocol, HTTP or SOCKS5. The protocol is fixed for each IP when you buy it.

  2. Step 2

    Generate the IPs, then open My assets (the console page that holds everything you bought) and copy HOST, PORT, USERNAME and PASSWORD. The Connect page shows a ready example with your own endpoint.

  3. Step 3

    Enter the details in the browser profile, tool or phone that will use the IP.

  4. Step 4

    Check the exit with https://ipinfo.io/json through the proxy. The country field should match the country you chose.

  5. Step 5

    From mainland China, start the helper tool from the Connect page first and keep it open while you use the proxy.

Prices and limits

A static ISP IP costs US$0.50 for one day and US$7.99 for 30 days, about US$0.27 per day, the same in every country. Availability changes daily and is shown on the order page. There is no free trial, and the smallest purchase is one IP for one day. An IP does not lift a restriction, undo a ban or raise a limit.

Reference links

5
  1. OpenAI API: Supported countries and territories

    Official documentation · Confirmed on:

    Read on 24 October 2026: accessing or offering access to OpenAI services outside the listed countries and territories "may result in your account being blocked or suspended."

  2. Codex docs: Authentication

    Official documentation · Confirmed on:

    Read on 24 October 2026: sign in with ChatGPT or with an API key; set CODEX_CA_CERTIFICATE to a PEM bundle before logging in behind a corporate TLS proxy, with SSL_CERT_FILE as the fallback.

  3. Codex source code (openai/codex): outbound proxy handling

    Official documentation · Confirmed on:

    Source read at commit 39850010 (23 October 2026): HTTPS_PROXY, then ALL_PROXY, is passed to the HTTP client; socks, socks4 and socks5 schemes are marked unsupported, and the HTTP client is built without SOCKS support.

    Source code, not user documentation; behaviour can change between versions.

  4. Microsoft Learn: setx

    Official documentation · Confirmed on:

    Read on 24 October 2026: syntax setx <variable> <value>, with no equals sign.

  5. Proxy302 product facts and price list

    Product observation · Confirmed on:

    Product facts file of the site (values checked against the console, the backend and the price table on 18-19 October 2026): products, prices in US$ (1 PTC = US$1), lease terms, protocols and ports, countries, quantity limits, no free trial.

Ready to try it?

Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.

Get started