Four ways to send OpenAI API calls through a proxy, from the quickest test to the code you keep: environment variables, curl, the Python SDK and the Node SDK, with a check of the exit IP and a note on SOCKS5.
OpenAI serves its API only in the countries on its supported list. A request from an unsupported location gets 403 “Country, region, or territory not supported”, and OpenAI states that accessing its services from outside the list may result in an account being blocked or suspended. A proxy changes the network exit your request leaves from. It does not make the API available where it is not and does not change OpenAI’s terms.
The OpenAI API proxy page explains which kind of IP to buy and how to put it on OpenAI’s IP allowlist. This guide is the setup manual: where each kind of proxy setting works, how to test it and what to do when it does not.
A proxy address with HOST, PORT, USERNAME and PASSWORD from My assets, and the protocol you bought it with: HTTP or SOCKS5. Each IP keeps that one protocol, so decide first which examples you will use. A datacenter IP costs US$3.99 for 30 days, the same in every country. If the password has special characters, percent-encode them in the URL (@ becomes %40, : becomes %3A, / becomes %2F), or you will get a 407 error.
| Item | Where it works | What to know |
|---|---|---|
| curl -x | One command, any machine | The -x option overrides proxy environment variables. Best first test. |
| Environment variables | Programs that read them: curl, and Node with NODE_USE_ENV_PROXY=1 | They apply to everything you start from that terminal. The SDK pages we read do not list them, so test each tool. |
| Python SDK client | Only the client you create | Documented: DefaultHttpx2Client(proxy=...). Nothing else on the machine is affected. |
| Node SDK fetchOptions | Only the client you create | Documented: undici fetch plus a ProxyAgent as dispatcher. Undici options must be paired with undici’s own fetch. |
Prefer the client setting for code you keep. Use environment variables for quick tests and for tools you did not write.
Run the three commands on the machine that will make the calls. The first must show the country you bought. The second prints a status number: 403 means the country is not supported; any other number, such as 401 for the missing key, means the country was not the reason (OpenAI’s error page does not describe requests without a key, so this is our reading). The third lists models with your key and proves the key works through the proxy.
# 1) Which IP and country does the world see through the proxy?
curl -x "http://USERNAME:PASSWORD@HOST:PORT" https://ipinfo.io/json
# 2) Does OpenAI accept this exit? Without a key: 403 = unsupported country; 401 = not a country problem
curl -s -o /dev/null -w "%{http_code}\n" -x "http://USERNAME:PASSWORD@HOST:PORT" \
https://api.openai.com/v1/models
# 3) With your key: 200 and the list of models
curl -x "http://USERNAME:PASSWORD@HOST:PORT" https://api.openai.com/v1/models \
-H "Authorization: Bearer $OPENAI_API_KEY"Replace HOST, PORT, USERNAME and PASSWORD with the values from My assets. The third call only lists models, so it is a safe first test of the key.
Many programs read HTTPS_PROXY and HTTP_PROXY. Tools differ on upper or lower case (the curl manual itself writes http_proxy in lower case and HTTPS_PROXY in capitals), so set both. NO_PROXY is a comma-separated list of hosts that skip the proxy. For Node, the documentation says that when NODE_USE_ENV_PROXY=1 is set (or node runs with --use-env-proxy), the global agent reads these variables, and its proxy URLs can be HTTP or HTTPS; SOCKS5 is not mentioned there. For Python, the pages we read describe the proxy argument but do not list HTTPS_PROXY for the OpenAI SDK, so do not rely on it: pass the proxy to the client as in steps 3 and 4, or confirm with the check.
# macOS / Linux (bash, zsh). Put the details in a variable once.
export PROXY_URL="http://USERNAME:PASSWORD@HOST:PORT"
export HTTP_PROXY="$PROXY_URL"
export HTTPS_PROXY="$PROXY_URL"
export http_proxy="$PROXY_URL"
export https_proxy="$PROXY_URL"
export NO_PROXY="localhost,127.0.0.1"
# Windows PowerShell
# $env:HTTPS_PROXY = "http://USERNAME:PASSWORD@HOST:PORT"
# $env:HTTP_PROXY = $env:HTTPS_PROXYReplace HOST, PORT, USERNAME and PASSWORD with the values from My assets. These variables stay only in the terminal you set them in.
Current versions of the OpenAI Python SDK are built on HTTPX2. DefaultHttpx2Client keeps the SDK’s recommended timeout, connection and redirect defaults and adds the proxy; the older DefaultHttpxClient name still works. The same client can fetch ipinfo.io, so the first printed line shows exactly the exit the SDK uses.
# pip install -U "openai[httpx2]" (needs Python 3.10 or later; reads OPENAI_API_KEY from the environment)
from openai import OpenAI, DefaultHttpx2Client
PROXY = "http://USERNAME:PASSWORD@HOST:PORT" # HTTP line; for SOCKS5 see below
http = DefaultHttpx2Client(proxy=PROXY)
# 1) Which IP does the proxy show?
print(http.get("https://ipinfo.io/json").text)
# 2) Use the same client for the API
client = OpenAI(http_client=http)
for model in client.models.list():
print(model.id)
# SOCKS5: pip install "httpx2[socks]", then use this line instead
# PROXY = "socks5://USERNAME:PASSWORD@HOST:PORT"The proxy credentials go in the userinfo part of the URL, as HTTPX2 documents. For SOCKS5, install httpx2[socks] and use the commented socks5:// line instead.
The OpenAI Node SDK documents this setup: import fetch and ProxyAgent from undici, give the client undici’s fetch and the agent as fetchOptions.dispatcher. The SDK states that undici options like dispatcher must be paired with the matching fetch, so do not mix undici’s ProxyAgent with another fetch. undici sends the username and password from the URL as proxy authentication and decodes them first. Bun and Deno have their own options in the SDK README.
// npm install openai undici (reads OPENAI_API_KEY from the environment)
// Save as check.mjs and run: node check.mjs
import OpenAI from 'openai';
import { fetch, ProxyAgent } from 'undici';
// If the password has special characters, wrap it: encodeURIComponent(password)
const dispatcher = new ProxyAgent('http://USERNAME:PASSWORD@HOST:PORT');
// 1) Which IP does the proxy show?
const ip = await fetch('https://ipinfo.io/json', { dispatcher });
console.log(await ip.text());
// 2) The same dispatcher for the API
const client = new OpenAI({ fetch, fetchOptions: { dispatcher } });
for await (const model of client.models.list()) {
console.log(model.id);
}
// SOCKS5: use this line instead
// const dispatcher = new ProxyAgent('socks5://USERNAME:PASSWORD@HOST:PORT');
// Built-in route for HTTP proxies, Node 22.21+ / 24.5+, no SDK code:
// NODE_USE_ENV_PROXY=1 HTTPS_PROXY="http://USERNAME:PASSWORD@HOST:PORT" node check.mjsSave as check.mjs. The first request prints the exit IP, the second lists models. For SOCKS5, swap in the commented line. The commented last line is Node’s built-in environment-variable route for HTTP proxies (Node 22.21 or 24.5 and newer); the SDK pages do not list it, so check it with a request.
HTTP is the simplest: every example here takes an HTTP proxy URL, and HTTP proxies are what Node’s environment-variable route documents. SOCKS5 works in the three places below, and you must have bought the IP as SOCKS5 because the protocol is chosen when you buy the IP, and an IP has just one.
curl accepts socks5:// and socks5h:// in the -x option (the manual lists both); our Python requests guide uses socks5h. Python SDK: install httpx2[socks] and use a socks5:// URL, as the HTTPX2 documentation says. Node SDK: undici handles socks5: URLs in ProxyAgent. Node’s built-in environment-variable support lists HTTP and HTTPS proxy URLs only.
# SOCKS5 line of the same IP (use the SOCKS5 port from My assets)
curl -x "socks5h://USERNAME:PASSWORD@HOST:PORT" https://ipinfo.io/jsonReplace HOST, PORT, USERNAME and PASSWORD with the values from My assets. Use the SOCKS5 port and the IP bought as SOCKS5.
Check Does ipinfo.io through the same proxy show a supported country, and does the client really use the proxy?
Fix Pass the proxy to the client that calls the API, as in steps 3 and 4, and use an IP in a supported country.
Check Is there a special character in the password that was not encoded, or has the IP’s term ended?
Fix Percent-encode the password in the URL, or copy the details again from My assets, and check the end date.
Check Is the exit IP on the allowlist that applies to the key?
Fix Send the request from an allowed IP or update the allowlist in OpenAI’s settings.
Check Is NODE_USE_ENV_PROXY=1 set, and does the SDK use the global fetch?
Fix Set the dispatcher on the client as in step 4, which is the documented route.
Check Does the machine have the operating system’s CA certificates? HTTPX2 changed its default trust store.
Fix Install the CA certificates, or set SSL_CERT_FILE to a CA bundle. A proxy that replaces certificates needs its certificate trusted the same way.
A datacenter IP costs US$0.25 for one day and US$3.99 for 30 days, the same in every country; a static ISP IP costs US$7.99 for 30 days. Quantity takes up to 100 IPs per order, and there is no free trial. The OpenAI API proxy page explains which type to choose.
For curl, yes. For Node, with NODE_USE_ENV_PROXY=1 on a Node version that has built-in proxy support, the global agent reads it, but the SDK pages we read do not list it, so confirm with the first request. For Python, the pages we read describe the proxy argument and not the variable, so pass proxy= to the client.
HTTP unless you have a reason. SOCKS5 works in curl, in the Python SDK with httpx2[socks] and in undici, but not in Node’s environment-variable route.
Only the client you configure, unless you export environment variables, which apply to everything started from that terminal.
No. A proxy changes only the network exit. OpenAI’s supported-country list and terms still apply.
Call the OpenAI API from a supported country on a fixed datacenter IP: set it in the Python or Node SDK, and add the fixed address to OpenAI’s IP allowlist.
View options and pricingHow to use HTTP and SOCKS5 proxies in Python requests: examples, timeouts and an IP check.
Ways to use an HTTP or SOCKS5 proxy in Node.js, with short examples and an exit check.
Check the exit IP, country and ISP your proxy really gives you in 30 seconds — and why IP databases disagree on the city. With our own test of three lookup services.
Set a proxy for ChatGPT in a browser, in the macOS and Windows apps and on iPhone and Android over Wi-Fi, and check the exit IP.
Official documentation · Confirmed on:
Read on 2 November 2026: accessing or offering access to OpenAI’s services outside the listed countries and territories may result in an account being blocked or suspended; mainland China, Hong Kong and Russia are not listed.
Official documentation · Confirmed on:
Read on 2 November 2026: 403 “Country, region, or territory not supported” means you are accessing the API from an unsupported country, region or territory; 401 “IP not authorized” means the request IP does not match the configured allowlist.
Official documentation · Confirmed on:
Read on 2 November 2026: DefaultHttpx2Client(proxy=...) is shown with a proxy set on the client; the helpers preserve the SDK’s recommended timeout, connection-pool and redirect defaults; DefaultHttpxClient still works and now builds HTTPX2 clients; HTTPX2 changes the default TLS trust store from certifi, and verify can take an ssl.SSLContext; SSL_CERT_FILE and SSL_CERT_DIR are honoured when trust_env=True (the default).
The page does not describe HTTP_PROXY or HTTPS_PROXY.
Official documentation · Confirmed on:
Read on 2 November 2026: the proxy parameter on client initialization; credentials in the userinfo section of the proxy URL; SOCKS support needs pip install httpx2[socks] and a socks5:// URL.
The page does not describe proxy environment variables.
Official documentation · Confirmed on:
Read on 2 November 2026: on Node, import fetch and ProxyAgent from undici and pass fetchOptions: { dispatcher }; undici-specific options like dispatcher must be paired with the matching fetch; Bun takes a proxy key in fetchOptions and Deno a client from Deno.createHttpClient.
The README does not mention proxy environment variables.
Official documentation · Confirmed on:
Read on 2 November 2026: with NODE_USE_ENV_PROXY=1 or --use-env-proxy the global agent is built from the environment variables HTTP_PROXY, HTTPS_PROXY and NO_PROXY (lower-case versions take precedence); proxy URLs can be http:// or https://, with a username and password; http.setGlobalProxyFromEnv() enables it for fetch() and http.request()/https.request(); the feature is added in v24.5.0 and v22.21.0 and marked stability 1.1, active development.
SOCKS5 is not mentioned in that section.
Official documentation · Confirmed on:
Read on 2 November 2026: ProxyAgent routes requests through an HTTP, HTTPS or SOCKS5 proxy; socks5: and socks: URIs are handled by Socks5ProxyAgent; the proxy-authorization header comes from the username and password in the URI, URL-decoded.
The page does not mention environment variables.
Official documentation · Confirmed on:
Read on 2 November 2026: socks4://, socks4a://, socks5:// and socks5h:// are accepted in the proxy string; no scheme or http:// means an HTTP proxy; the user and password in the proxy string are URL-decoded; the option overrides proxy environment variables.
The page we read does not explain the difference between socks5 and socks5h.
Official documentation · Confirmed on:
Read on 2 November 2026: curl reads http_proxy, HTTPS_PROXY and ALL_PROXY; NO_PROXY lists hosts that skip the proxy; -x overrides the environment variables.
The page lists http_proxy in lower case and the others in capitals.
Product observation · Confirmed on:
Product facts file of the site (values checked against the console, the backend and the price table on 18-19 October 2026), read on 2 November 2026: datacenter per-IP lease US$0.25 for 1 day and US$3.99 for 30 days, the same in every country; static ISP US$7.99 for 30 days; HTTP or SOCKS5 chosen per purchase and one protocol per IP; quantity up to 100 per order; no free trial.
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.
