Getting Claude Code to See the Aggregator's Base URL Behind a Corporate Proxy

Understanding the Setup

When using Claude Code (or similar CLI tools) with an aggregator that provides an OpenAI-compatible API, you often need to work behind a corporate proxy. This guide explains how to configure your environment so that Claude Code correctly reaches the aggregator's endpoint, even when TLS interception is in play.

Proxy Environment Variables

Most CLI tools respect standard proxy environment variables. Set these before running Claude Code:

• HTTPPROXY / httpproxy: Proxy URL for HTTP requests.
• HTTPSPROXY / httpsproxy: Proxy URL for HTTPS requests.
• NOPROXY / noproxy: Comma-separated list of hosts to bypass the proxy.

For example, in a Unix-like shell:

export HTTPS_PROXY="http://proxy.corp.example:8080"
export HTTP_PROXY="http://proxy.corp.example:8080"
export NO_PROXY="localhost,127.0.0.1,.internal"

Ensure the proxy URL includes the scheme (http or https) and the port. If your proxy requires authentication, include credentials in the URL (e.g., http://user:pass@proxy:8080).

TLS Interception Pitfalls

Corporate proxies often intercept TLS connections to inspect traffic. This means the proxy presents its own certificate, which may not be trusted by your system or the tool. Common issues include:

• Certificate verification failures: The tool may reject the proxy's certificate. You might need to add the corporate CA certificate to your system's trust store or configure the tool to use it.
• SNI and hostname mismatches: Some proxies alter the SNI or hostname, causing certificate validation errors.

To mitigate, you can:

• Install the corporate root CA certificate into your OS trust store.
• Set NODEEXTRACA_CERTS to point to a PEM file containing the corporate CA, if the tool is Node.js-based.
• For Python-based tools, set REQUESTSCABUNDLE or SSLCERTFILE to the CA bundle path.

Always avoid disabling TLS verification (NODETLSREJECT_UNAUTHORIZED=0 or --insecure) in production, as it weakens security.

Base-URL Overrides

Claude Code may default to an official Anthropic endpoint. To use the aggregator's OpenAI-compatible endpoint, you need to override the base URL. This is typically done via environment variables or configuration flags.

Look for variables such as:

• ANTHROPICBASEURL (if the tool supports Anthropic-style APIs)
• OPENAIBASEURL or OPENAIAPIBASE (for OpenAI-compatible endpoints)
• Tool-specific flags like --base-url

For an OpenAI-compatible aggregator, set the base URL to the aggregator's endpoint, for example:

export OPENAI_BASE_URL="https://api.aggregator.example/v1"

Also set the API key as required by the aggregator (e.g., OPENAIAPIKEY).

Putting It All Together

Combine proxy settings, TLS trust, and base URL overrides:

1. Set proxy environment variables.
2. Ensure the corporate CA is trusted (via system store or tool-specific variables).
3. Override the base URL to point to the aggregator.
4. Set the API key.
5. Run Claude Code.

Example:

export HTTPS_PROXY="http://proxy.corp.example:8080"
export NO_PROXY="localhost,127.0.0.1"
export NODE_EXTRA_CA_CERTS="/path/to/corp-ca.pem"
export OPENAI_BASE_URL="https://api.aggregator.example/v1"
export OPENAI_API_KEY="your-api-key"
claude-code

Troubleshooting Tips

• Connection timeouts: Verify proxy address and port; check NO_PROXY does not exclude the aggregator host.
• Certificate errors: Confirm the CA certificate is correctly installed and referenced.
• 404 or 401 errors: Double-check the base URL path (e.g., /v1) and API key.
• Proxy authentication: Embed credentials in the proxy URL or use tool-specific auth mechanisms.

By following these steps, you can reliably connect Claude Code to the aggregator's endpoint behind a corporate proxy.