Enterprise network configuration

Claude Code supports various enterprise network and security configurations through environment variables. This includes routing traffic through corporate proxy servers, trusting custom Certificate Authorities (CA), and authenticating with mutual Transport Layer Security (mTLS) certificates for enhanced security. Set these environment variables before you launch Claude Code. Variables exported in your shell are read once at startup, so a running session doesn’t pick up later changes to your shell environment.

All environment variables shown on this page can also be configured in settings.json.

Proxy configuration

Environment variables

Claude Code respects standard proxy environment variables. In Claude Desktop sessions where the app manages the provider connection, Claude Code reads them only from managed settings and ~/.claude/settings.json; see mTLS authentication for the scope rules.

# HTTPS proxy (recommended)
export HTTPS_PROXY=https://proxy.example.com:8080

# HTTP proxy (if HTTPS not available)
export HTTP_PROXY=http://proxy.example.com:8080

# Bypass proxy for specific requests - space-separated format
export NO_PROXY="localhost 192.168.1.1 example.com .example.com"
# Bypass proxy for specific requests - comma-separated format
export NO_PROXY="localhost,192.168.1.1,example.com,.example.com"
# Bypass proxy for all requests
export NO_PROXY="*"

Lowercase variants also work, and Claude Code uses the first one that’s set in the order https_proxy, HTTPS_PROXY, http_proxy, HTTP_PROXY.

Claude Code does not support SOCKS proxies.

Basic authentication

If your proxy requires basic authentication, include credentials in the proxy URL:

export HTTPS_PROXY=http://username:password@proxy.example.com:8080

Avoid hardcoding passwords in scripts. Use environment variables or secure credential storage instead.

For proxies requiring advanced authentication (NTLM, Kerberos, etc.), consider using an LLM Gateway service that supports your authentication method.

CA certificate store

By default, Claude Code trusts both its bundled Mozilla CA certificates and your operating system’s certificate store. Reading the OS store requires a runtime with tls.getCACertificates: the native installer always has it, and npm installs need Node 22.15 or later. On older Node versions, only the bundled set and NODE_EXTRA_CA_CERTS apply. Enterprise TLS-inspection proxies such as CrowdStrike Falcon and Zscaler work without additional configuration when their root certificate is installed in the OS trust store and the runtime can read it. CLAUDE_CODE_CERT_STORE accepts a comma-separated list of sources. Recognized values are bundled for the Mozilla CA set shipped with Claude Code and system for the operating system trust store. The default is bundled,system. To trust only the bundled Mozilla CA set:

export CLAUDE_CODE_CERT_STORE=bundled

To trust only the OS certificate store:

export CLAUDE_CODE_CERT_STORE=system

CLAUDE_CODE_CERT_STORE has no dedicated settings.json schema key. Set it via the env block in ~/.claude/settings.json or directly in the process environment.

Custom CA certificates

If your enterprise environment uses a custom CA, configure Claude Code to trust it directly:

Setup and access

Deployment

Gateways

Usage and costs

Plugin distribution

Security and data

Adoption

Enterprise network configuration

Proxy configuration

Environment variables

Basic authentication

CA certificate store

Custom CA certificates

​Proxy configuration

​Environment variables

​Basic authentication

​CA certificate store

​Custom CA certificates

Proxy configuration

Environment variables

Basic authentication

CA certificate store

Custom CA certificates