Codex Network Proxy: Set HTTPS_PROXY for Codex CLI

Key Environment Variables for Proxies

Command-line tools usually read standard proxy-related environment variables; check the documentation for your version of Codex CLI to see which ones it reads. In practice, two variables are enough: HTTPS_PROXY and NO_PROXY.

HTTPS_PROXY specifies the proxy address for HTTPS requests (this is the protocol the OpenAI API uses). The value format is http://host:port. Codex CLI does not support SOCKS5 proxies, so use an HTTP asset (port 2222 on Proxy302). If the proxy requires authentication, the username and password are embedded directly in the URL: http://username:password@host:port.

HTTP_PROXY is used for regular HTTP requests. In most cases, a single HTTPS_PROXY is sufficient, but if both variables are set, each is applied to its own type of request.

ALL_PROXY acts as a universal fallback: if the variable for a specific protocol is not set, ALL_PROXY is used instead. This is convenient when you have a single proxy for all traffic.

NO_PROXY (or no_proxy) is a list of hosts and domains that should be connected to directly, without the proxy. Default values: localhost,127.0.0.1. If you have internal services or corporate network domains, add them to this list separated by commas.

• Sources:
• Codex source code (openai/codex): outbound proxy handling

Setup on macOS and Linux

For a temporary setup in the current terminal session, use the export command:

Setup on macOS and Linux: example

export HTTPS_PROXY="http://username:password@proxy-host:port"
export NO_PROXY="localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

Setup on macOS and Linux, continued

To make the variables permanent, add the export lines to your shell's profile file. For Bash, this is ~/.bash_profile or ~/.bashrc; for Zsh, it is ~/.zshrc. After saving the file, restart the terminal or run source ~/.bashrc.

You can verify that the variables are set with the command env | grep -i proxy.

Setup on Windows PowerShell

In PowerShell, the current session uses the $env: syntax:

Setup on Windows PowerShell: example

$env:HTTPS_PROXY = "http://username:password@proxy-host:port"
$env:NO_PROXY = "localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

Permanent setup on Windows with setx

For permanent setup, use the setx command, which writes the variables to the user registry:

Permanent setup on Windows with setx: example

setx HTTPS_PROXY "http://username:password@proxy-host:port"
setx NO_PROXY "localhost,127.0.0.1"

Example only: replace the placeholder values with your own.

• Sources:
• Microsoft Learn: setx

After setx: restart and system-wide variables

After running setx, restart PowerShell for the changes to take effect. For system-level variables (available to all users), run PowerShell as administrator and use [System.Environment]::SetEnvironmentVariable().

Checking the Exit Country Before You Start

Before sending requests, check which IP address and country the proxy actually gives you, so you know traffic goes through it. The simplest way is a request through the proxy to any IP geolocation service:

Checking the Exit Country Before You Start: example

curl -x "http://username:password@proxy-host:port" https://ipinfo.io/json

Example only: replace the placeholder values with your own.

Checking the Exit Country Before You Start, continued

In the response, the ip field is the exit IP that OpenAI sees and the country field is its country. If the address is not the one you expect, traffic is not going through the proxy: check the variables again.

Which countries are supported is detailed in the guide to countries where ChatGPT, Claude, and Gemini work.

• guide to countries where ChatGPT, Claude, and Gemini work

Why the Exit Country Matters for the OpenAI API

OpenAI publishes a list of countries and territories where its API operates. Requests coming from a non-supported region receive a response with code 403 and the error text "Country, region, or territory not supported".

A proxy only changes the network address visible to the service. The platform itself makes the access decision based on the IP address and other factors, and a proxy does not change OpenAI's terms. OpenAI warns that using its services from outside the supported list may get the account blocked or suspended. If you sign in with a ChatGPT account, ChatGPT's supported countries apply; with an API key, the OpenAI API list applies.

For Codex CLI on Proxy302, use an HTTP IP on port 2222; the host, username and password are shown in My assets.

• Sources:
• OpenAI API: Supported countries and territories
• Codex docs: Authentication

Proxy URL Authentication

If the proxy requires a username and password, pass them directly in the URL of the environment variable:

Proxy URL Authentication: example

HTTPS_PROXY=http://user:password@host:port

Example only: replace the placeholder values with your own.

Proxy URL Authentication, continued

A password may contain special characters (@, :, /, ?, #, %), which have meaning in a URL. They must be escaped using URL encoding (percent-encoding): @ becomes %40, : becomes %3A, / becomes %2F, and so on. For example, if the password is my@pass:123, it should look like my%40pass%3A123 in the URL.

Common Mistakes and Fixes

Error 407 Proxy Authentication Required. The proxy received the request but did not accept the credentials. Check the correctness of the username and password in the URL, and make sure special characters are escaped. If the problem persists, ask your proxy administrator which type of authentication it requires.

Certificate errors. If a corporate proxy re-signs TLS, point CODEX_CA_CERTIFICATE at a PEM file with the company root CA before running codex login (Codex falls back to SSL_CERT_FILE when it is unset).

Timeouts. If requests hang and do not complete, the proxy is likely not configured or the address is incorrect. Check the variables with the command env | grep -i proxy, make sure the URL includes a scheme (http://), and that the port and host are accessible.

Error "Country, region, or territory not supported". A 403 means OpenAI does not support the region the request comes from; a proxy does not change that. OpenAI warns that using its services from outside the supported list may get the account blocked or suspended.

Full setup for the OpenAI API is on the OpenAI API proxies page. Claude Code works the same way; see the Claude Code proxy setup guide.

• OpenAI API proxies page
• Claude Code proxy setup guide

• Sources:
• Codex docs: Authentication
• OpenAI API: Supported countries and territories

How do I make proxy variables permanent on macOS?

Add the lines export HTTPS_PROXY=... and export NO_PROXY=... to the file ~/.zshrc (macOS Catalina and newer) or ~/.bash_profile, then restart the terminal.

Can I use SOCKS5 with Codex CLI?

No. Codex CLI accepts only HTTP proxies (http://) in HTTPS_PROXY and ALL_PROXY; buy the IP with the HTTP protocol (port 2222).

• Sources:
• Codex source code (openai/codex): outbound proxy handling

Why does Codex CLI not see proxy variables in VS Code?

The extension starts Codex with VS Code's own environment. If you set the variables after VS Code was opened, quit and reopen it fully, or launch it from a terminal where the variables are set (code .). On Windows, set them permanently with setx and restart VS Code.

Do I need to add the proxy to the OpenAI IP allowlist?

Only if your organization has an IP allowlist enabled in OpenAI. Then add the proxy's exit IP (the one https://ipinfo.io/json shows through the proxy), not the proxy host; this needs a static IP, because a rotating exit changes.

Give Codex CLI a proxy tool with MCP

MCP adds tools to Codex CLI. With the proxy302-mcp server, Codex can get a Proxy302 proxy and fetch pages through it. Add it with one command, or write the same entry into ~/.codex/config.toml.

proxy302-mcp is the official Proxy302 MCP server, open source on GitHub and maintained by the Proxy302 team. Proxy302 also runs it at https://proxy302.com/v1/mcp: clients that can send an Authorization header, such as Claude Code, Cursor and VS Code, connect with an API key and install nothing.

This is a separate setting from the proxy variables on this page. HTTPS_PROXY decides how Codex CLI itself reaches OpenAI; the MCP server's tools have their own settings, and installing the server does not change how Codex connects. The guide to the Proxy302 MCP server covers the tools, the other clients and the limits.

• Proxy302 MCP server guide

• Sources:
• Codex docs: Model Context Protocol
• proxy302-mcp README (official Proxy302 MCP server)

Give Codex CLI a proxy tool with MCP: codex mcp add

codex mcp add proxy302 --env PROXY302_API_KEY="<key id>:<secret>" -- npx -y github:proxy302/proxy302-mcp

Replace <key id>:<secret> with your Proxy302 API key.

• Sources:
• Codex docs: Model Context Protocol

Give Codex CLI a proxy tool with MCP: config.toml

[mcp_servers.proxy302]
command = "npx"
args = ["-y", "github:proxy302/proxy302-mcp"]
env = { PROXY302_API_KEY = "<key id>:<secret>" }

The same entry in the config file. Replace <key id>:<secret> with your Proxy302 API key.

• Sources:
• Codex docs: Model Context Protocol

How to do it with Proxy302

A static ISP lease fits this routine: the IP stays fixed while the lease runs and does not rotate, so one address stays with one account or one tool. The page on OpenAI API proxies has the preset and the full setup, and the static ISP page describes the product.

• OpenAI API proxies
• static ISP page

How to do it with Proxy302: steps

1. Step 1

   Open the static ISP page, choose the country, the term and the quantity, and the protocol, HTTP or SOCKS5. The protocol is fixed for each IP when you buy it.

2. Step 2

   Generate the IPs, then open My assets (the console page that holds everything you bought) and copy HOST, PORT, USERNAME and PASSWORD. The Tools & checks page shows a ready example with your own endpoint.

3. Step 3

   Enter the details in the browser profile, tool or phone that will use the IP.

4. Step 4

   Check the exit with https://ipinfo.io/json through the proxy. The country field should match the country you chose.

5. Step 5

   From mainland China, open Proxy302 Fast Connect from the Tools & checks page, click 「一键加速」 (One-click boost) and keep it open while you use the proxy.

   • Fast Connect guide

Prices and limits

A static ISP IP costs US$0.50 for one day and US$7.99 for 30 days, about US$0.27 per day, the same in every country. Availability changes daily and is shown on the order page. There is no free trial, and the smallest purchase is one IP for one day. An IP does not lift a restriction, undo a ban or raise a limit.

• On a budget? Choose a regular static residential IP

• Sources:
• Proxy302 product facts and price list

Proxy302 at a glance

Prices are in PTC, paid from the wallet; 1 PTC = US$1. There is no free trial: the smallest purchase is 1 GB of rotating residential traffic or one IP for one day. Checked on 4 November 2026.

• Sources:
• Proxy302 product facts and price list
• Proxy302 ISP for AI subscriptions: public catalog

Read next

OpenAI API proxies

Call the OpenAI API from a supported country on a fixed datacenter IP: set it in the Python or Node SDK, and add the fixed address to OpenAI’s IP allowlist.

View options and pricing

Claude Code proxy setup

How to run Claude Code behind an HTTP proxy: HTTPS_PROXY, NO_PROXY, settings.json for background agents, and the checks that show it works.

ChatGPT, Claude and Gemini supported countries

The four official availability lists compared country by country — China, Hong Kong, Russia and more — plus hourly checks of the OpenAI and Anthropic APIs from 7 countries.

ISP proxies (static residential)

Fixed static ISP proxies: a residential-grade IP that stays the same for the whole term. For social accounts, stores and AI tools. HTTP and SOCKS5.

View options and pricing

Proxy MCP server for AI coding tools

What a proxy MCP server is, how local and remote MCP servers differ, how to install one in Claude Code, Codex CLI and Cursor, and how to route the server's own traffic through a proxy.