ailiteracynepal 🇳🇵
Text size

Chapter 05 · Section III · 10 min read

5.3 Network config: proxies, gateways, SSL/TLS

What to configure when Claude Code has to speak through corporate proxies, LLM gateways, or with custom CA bundles — the three network surfaces that break enterprise installs.

On a laptop with direct internet, Claude Code just works. In a corporate environment there are usually three obstacles: a required outbound proxy, an LLM gateway that intercepts traffic, and a custom certificate authority the org’s PKI insists on. Fix these three and Claude Code behaves.

Corporate proxies

Claude Code respects the standard proxy env vars:

export HTTPS_PROXY=http://proxy.corp.local:8080
export HTTP_PROXY=http://proxy.corp.local:8080
export NO_PROXY=localhost,127.0.0.1,.corp.local

Set these once in your shell profile. NO_PROXY should include any internal MCP servers or internal endpoints you do not want routed through the proxy.

Auth-required proxies (basic auth):

export HTTPS_PROXY=http://user:$PASS@proxy.corp.local:8080

Store the password in a keyring; never commit the URL as-is.

LLM gateways

Many enterprises now sit an “LLM gateway” between developers and any AI provider — for logging, cost attribution, PII scrubbing, model allowlisting. Configure Claude Code to speak to the gateway instead of Anthropic directly:

{
  "provider": "anthropic",
  "anthropic": {
    "base_url": "https://llm-gateway.corp.local/anthropic/v1"
  }
}

The gateway forwards to the real API, records what happened, and enforces central policy. From Claude Code’s perspective it is just a different endpoint.

Gateways like LiteLLM, Portkey, or homegrown ones typically expose an Anthropic-compatible API surface — pointing base_url at them is the whole config.

Custom CA bundles

If the proxy or gateway terminates TLS with a corporate certificate, the OS CA store may not trust it. Signal is SSL certificate verify failed in the logs.

export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/corp-root-ca.pem

Node reads this on startup; Claude Code inherits it. For a fleet, ship the CA in your provisioning scripts and set the env var globally.

Diagnosing

Two commands that save a lot of time:

claude doctor           # environment check: proxies, CAs, model access
curl -v $BASE_URL       # confirm reachability at the network layer

Most enterprise-network Claude Code problems reduce to one of: wrong proxy setting, missing CA, or a gateway URL that changed. claude doctor surfaces the first two; curl isolates the third from Claude Code itself.

Check your understanding

Quick check

—

Your team has just deployed an internal LLM gateway that logs and rate-limits Anthropic traffic. It exposes an Anthropic-compatible API at `https://llm.corp.local/anthropic/v1`. How do you point Claude Code at it?