Blog / Developer tools

Claude Code Network Requirements: Domains, Ports and Proxy vs Codex

2026-10-21cdnping editors7 min read

Claude Code's network requirements are outbound HTTPS (port 443) to Anthropic's API and login domains. It needs no inbound ports and no UDP. Codex is similar: outbound HTTPS to OpenAI's API or ChatGPT login domains is enough, and the one thing to watch is that browser login starts a callback port on your local machine. In practice, the problems usually come from proxy type, TLS interception and long-connection timeouts.

This article only covers what you can verify in the two vendors' official documentation. Both tools change quickly, so treat the current official docs as the source of truth for domain lists: for Claude Code, see the "Network configuration / Corporate proxy" page in Anthropic's docs; for Codex, see OpenAI's Codex docs and the configuration notes in the GitHub repository.

#Which domains do the two tools need to reach?

#Claude Code

Three categories, by purpose:

If you use Claude Code through Amazon Bedrock, Google Vertex AI or a custom ANTHROPIC_BASE_URL, model calls no longer go to api.anthropic.com. Your allowlist then needs the matching cloud service endpoint or your own gateway address instead.

#Codex

localhost:1455 is where many people get stuck on remote servers: you run login on an SSH machine, but the browser is on your local computer, so the callback never reaches the server. The official docs suggest one of these: set up a one-time SSH port forward (ssh -L 1455:localhost:1455 user@host), log in locally and copy the credentials file over, or just use an API key.

#What do the ports and protocols need to look like?

Both only need outbound TCP 443. A few more points:

• No inbound ports are needed. Codex's port 1455 listens on the loopback address only.
• Responses are long-lived streaming HTTPS. A single agent task can run for several minutes, and the connection stays open the whole time. If a proxy or firewall has a short idle timeout, or buffers the entire response before forwarding it, you will see "hangs, then drops."
• IPv6: if your system prefers IPv6 but your proxy only handles IPv4, requests may bypass the proxy. See Troubleshooting IPv4 and IPv6 exit mismatches on dual-stack networks.

#How do you configure a proxy?

#Claude Code

Claude Code reads the standard proxy environment variables:

export HTTPS_PROXY=http://proxy.example.com:8080
export HTTP_PROXY=http://proxy.example.com:8080
export NO_PROXY="localhost,127.0.0.1,.internal.example.com"

A few things to note (all from Anthropic's official documentation):

• The official docs state that SOCKS proxies are not supported. If you only have a local SOCKS5 port, switch to the HTTP port your proxy software provides.
• If your company does TLS interception (a man-in-the-middle certificate), use NODE_EXTRA_CA_CERTS=/path/to/ca.pem to point to the corporate root certificate.
• If you need client certificates (mTLS), use CLAUDE_CODE_CLIENT_CERT and CLAUDE_CODE_CLIENT_KEY.
• To reduce the number of domains you need to allow, set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1, which turns off non-essential requests such as telemetry and error reporting. You can also disable them individually with DISABLE_TELEMETRY and DISABLE_ERROR_REPORTING.
• These variables can also go in the env field of settings.json. Distributing them centrally to the team is more reliable than having everyone edit their shell config.

#Codex

Codex CLI also reads HTTPS_PROXY / HTTP_PROXY / NO_PROXY. How to configure a corporate root certificate has changed between versions, so check the current custom-CA notes in the official repository before deciding which environment variable to use.

Codex differs from Claude Code in one respect: Codex's own network access and the network access of commands it runs in its sandbox are two separate things. In the default workspace-write sandbox mode, commands the agent runs (for example npm install, pip install, curl) have no network by default. If you really need it, enable it in ~/.codex/config.toml:

[sandbox_workspace_write]
network_access = true

So when "Codex replies fine but fails with a network error while installing dependencies," it is usually not a broken proxy but the sandbox policy. Claude Code's sandbox mode also has similar outbound domain restrictions, so first confirm whether the error comes from the tool itself or from a command it ran.

#How do you write a firewall allowlist request?

When asking a network administrator for access, splitting the request into "required / as needed / can be disabled" gets through approval more easily than dumping a long list of domains. Here is a template you can adapt directly:

Purpose: developers using the Claude Code / Codex command-line tools
Protocol: outbound TCP 443 (HTTPS), no inbound requirements
Requirement: allow long-lived streaming responses; idle timeout should be no shorter than 10 minutes

[Required - Claude Code]
api.anthropic.com

[As needed - Claude Code login, pick one]
claude.ai               (subscription account)
platform.claude.com     (API account)

[Required - Codex, pick one by login method]
api.openai.com          (API key)
chatgpt.com, auth.openai.com (ChatGPT account)

[As needed - install and upgrade]
Internal npm mirror, or registry.npmjs.org

[Can be disabled]
Claude Code telemetry and error reporting: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1

"Idle timeout no shorter than 10 minutes" is a conservative suggestion, not an official requirement; set it based on how long your actual tasks run.

If your company routes through a unified AI gateway (self-hosted or third-party), the list shrinks to the gateway's single domain. To see how to point both tools at a custom address, read Configuring a custom API endpoint for Claude Code and Codex. For example, AGI Plan is an aggregation gateway compatible with both the Anthropic and OpenAI API formats (AGI Plan is a commercial partner of cdnping). The service states clearly that it is not an officially authorized channel, so evaluate it yourself before choosing.

#How do you verify the network is working?

Run these on the machine where Claude Code or Codex will run, with the same environment variables as the tools:

# 1. Check whether the proxy variables took effect
env | grep -i proxy

# 2. Test connectivity to the Anthropic API (no key sent; an HTTP status like 401/405 means the network is working)
curl -sS -o /dev/null -w "%{http_code} connect=%{time_connect}s tls=%{time_appconnect}s\n" \
  https://api.anthropic.com/v1/messages

# 3. Test the OpenAI API
curl -sS -o /dev/null -w "%{http_code} connect=%{time_connect}s tls=%{time_appconnect}s\n" \
  https://api.openai.com/v1/models

# 4. See who issued the certificate (with TLS interception this shows your company CA)
curl -sv https://api.anthropic.com 2>&1 | grep -i "issuer"

How to read the results:

On the browser side, cdnping's online speed test shows first-connection time (including DNS and TLS handshake) and round-trip latency for both APIs, and the IP and environment check confirms your current exit IP, whether traffic is being split by routing rules, and whether DNS is leaking. For fuller steps, see the developer network self-check list; if you have already confirmed a Claude Code connection error, work through the four-layer network checklist.

#The network is fine, but it still won't connect?

Rule out a server-side outage first. cdnping probes each vendor's official API endpoints from the Cloudflare edge every 5 minutes. You can see the results on the Claude API status and OpenAI API status pages, and check reports from other users on Is Claude Code down? and Is Codex down?.

For reference: cdnping started collecting data on October 17, 2026. In the first window of about 85 minutes of probes (Cloudflare Denver, DEN), api.anthropic.com had a median of 73 ms and p95 of 84 ms, and api.openai.com had a median of 96 ms and p95 of 194 ms, with no failures for either. This only shows the server-side entry points look reachable from a US node. It says nothing about your own path to them, and the sample is still short.

Also, according to the official status page records cdnping syncs, since September 17, 2026 the Anthropic status page has logged 6 major-level incidents, and the OpenAI status page has logged 4 major and 19 minor incidents. One of them, on October 14 (UTC), was "Degraded performance in Codex and ChatGPT Work," lasting about 167 minutes. Checking the status page first can save you a detour. To understand incident severity levels, see How to read the OpenAI and Claude status pages.

One last case has nothing to do with the network: Anthropic and OpenAI only serve supported countries and regions, and accounts or requests from unsupported regions are rejected. These errors are usually a 403 with a region-related message. For the cause and the official policy, see Claude says your region is not supported. Please follow the terms of service and local regulations, and choose a compliant way to connect.