--- title: "Claude Code Network Requirements: Domains, Ports and Proxy vs Codex" description: "Domains, ports and proxy settings Claude Code and Codex need, with a firewall allowlist template, curl self-checks, and common blocked-request errors." url: https://cdnping.org/en/blog/claude-code-vs-codex-network-requirements language: en published: 2026-10-21 category: "Developer tools" tags: ["Claude Code","Codex","Corporate network","Firewall","Proxy"] source: cdnping.org license: Free to quote and summarize with a link to the url above. --- # Claude Code Network Requirements: Domains, Ports and Proxy vs Codex Claude Code's network requirements are outbound HTTPS (port 443) to Anthropic's API and login domains. It needs no inbound ports and no UDP. Codex is similar: outbound HTTPS to OpenAI's API or ChatGPT login domains is enough, and the one thing to watch is that browser login starts a callback port on your local machine. In practice, the problems usually come from proxy type, TLS interception and long-connection timeouts. This article only covers what you can verify in the two vendors' official documentation. Both tools change quickly, so treat the current official docs as the source of truth for domain lists: for Claude Code, see the "Network configuration / Corporate proxy" page in Anthropic's docs; for Codex, see OpenAI's Codex docs and the configuration notes in the GitHub repository. ## Which domains do the two tools need to reach? ### Claude Code Three categories, by purpose: | Purpose | Domain | Notes | |---|---|---| | Model calls | `api.anthropic.com` | All conversations and tool calls go here; must be allowed | | Account login | `claude.ai` | Needed when signing in with a Claude subscription account | | Account login | `platform.claude.com` (formerly the Console domain) | Needed when signing in with an API account (Console) | | Non-essential traffic | Telemetry and error reporting | Can be turned off with environment variables, see below | | Install and update | npm registry or the native installer's download address | Only needed when installing or upgrading | If you use Claude Code through Amazon Bedrock, Google Vertex AI or a custom `ANTHROPIC_BASE_URL`, model calls no longer go to `api.anthropic.com`. Your allowlist then needs the matching cloud service endpoint or your own gateway address instead. ### Codex | Purpose | Domain / address | Notes | |---|---|---| | Model calls (API key) | `api.openai.com` | Default address when signing in with an API key | | Model calls and login (ChatGPT account) | `chatgpt.com`, `auth.openai.com` | Needed when signing in with a ChatGPT account | | Login callback | `localhost:1455` | The browser calls back to your local machine after login; no external traffic | | Install and update | npm registry, Homebrew or GitHub Releases | Only needed when installing or upgrading | `localhost:1455` is where many people get stuck on remote servers: you run login on an SSH machine, but the browser is on your local computer, so the callback never reaches the server. The official docs suggest one of these: set up a one-time SSH port forward (`ssh -L 1455:localhost:1455 user@host`), log in locally and copy the credentials file over, or just use an API key. ## What do the ports and protocols need to look like? Both only need outbound TCP 443. A few more points: - No inbound ports are needed. Codex's port 1455 listens on the loopback address only. - Responses are long-lived streaming HTTPS. A single agent task can run for several minutes, and the connection stays open the whole time. If a proxy or firewall has a short idle timeout, or buffers the entire response before forwarding it, you will see "hangs, then drops." - IPv6: if your system prefers IPv6 but your proxy only handles IPv4, requests may bypass the proxy. See [Troubleshooting IPv4 and IPv6 exit mismatches on dual-stack networks](/en/blog/ipv6-dual-stack-proxy-mismatch). ## How do you configure a proxy? ### Claude Code Claude Code reads the standard proxy environment variables: ```bash export HTTPS_PROXY=http://proxy.example.com:8080 export HTTP_PROXY=http://proxy.example.com:8080 export NO_PROXY="localhost,127.0.0.1,.internal.example.com" ``` A few things to note (all from Anthropic's official documentation): - The official docs state that SOCKS proxies are not supported. If you only have a local SOCKS5 port, switch to the HTTP port your proxy software provides. - If your company does TLS interception (a man-in-the-middle certificate), use `NODE_EXTRA_CA_CERTS=/path/to/ca.pem` to point to the corporate root certificate. - If you need client certificates (mTLS), use `CLAUDE_CODE_CLIENT_CERT` and `CLAUDE_CODE_CLIENT_KEY`. - To reduce the number of domains you need to allow, set `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, which turns off non-essential requests such as telemetry and error reporting. You can also disable them individually with `DISABLE_TELEMETRY` and `DISABLE_ERROR_REPORTING`. - These variables can also go in the `env` field of `settings.json`. Distributing them centrally to the team is more reliable than having everyone edit their shell config. ### Codex Codex CLI also reads `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`. How to configure a corporate root certificate has changed between versions, so check the current custom-CA notes in the official repository before deciding which environment variable to use. Codex differs from Claude Code in one respect: Codex's own network access and the network access of commands it runs in its sandbox are two separate things. In the default `workspace-write` sandbox mode, commands the agent runs (for example `npm install`, `pip install`, `curl`) have no network by default. If you really need it, enable it in `~/.codex/config.toml`: ```toml [sandbox_workspace_write] network_access = true ``` So when "Codex replies fine but fails with a network error while installing dependencies," it is usually not a broken proxy but the sandbox policy. Claude Code's sandbox mode also has similar outbound domain restrictions, so first confirm whether the error comes from the tool itself or from a command it ran. ## How do you write a firewall allowlist request? When asking a network administrator for access, splitting the request into "required / as needed / can be disabled" gets through approval more easily than dumping a long list of domains. Here is a template you can adapt directly: ```text Purpose: developers using the Claude Code / Codex command-line tools Protocol: outbound TCP 443 (HTTPS), no inbound requirements Requirement: allow long-lived streaming responses; idle timeout should be no shorter than 10 minutes [Required - Claude Code] api.anthropic.com [As needed - Claude Code login, pick one] claude.ai (subscription account) platform.claude.com (API account) [Required - Codex, pick one by login method] api.openai.com (API key) chatgpt.com, auth.openai.com (ChatGPT account) [As needed - install and upgrade] Internal npm mirror, or registry.npmjs.org [Can be disabled] Claude Code telemetry and error reporting: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 ``` "Idle timeout no shorter than 10 minutes" is a conservative suggestion, not an official requirement; set it based on how long your actual tasks run. If your company routes through a unified AI gateway (self-hosted or third-party), the list shrinks to the gateway's single domain. To see how to point both tools at a custom address, read [Configuring a custom API endpoint for Claude Code and Codex](/en/blog/configure-custom-api-endpoint-claude-code-codex). For example, [AGI Plan](https://agiplan.dev) is an aggregation gateway compatible with both the Anthropic and OpenAI API formats (AGI Plan is a commercial partner of cdnping). The service states clearly that it is not an officially authorized channel, so evaluate it yourself before choosing. ## How do you verify the network is working? Run these on the machine where Claude Code or Codex will run, with the same environment variables as the tools: ```bash # 1. Check whether the proxy variables took effect env | grep -i proxy # 2. Test connectivity to the Anthropic API (no key sent; an HTTP status like 401/405 means the network is working) curl -sS -o /dev/null -w "%{http_code} connect=%{time_connect}s tls=%{time_appconnect}s\n" \ https://api.anthropic.com/v1/messages # 3. Test the OpenAI API curl -sS -o /dev/null -w "%{http_code} connect=%{time_connect}s tls=%{time_appconnect}s\n" \ https://api.openai.com/v1/models # 4. See who issued the certificate (with TLS interception this shows your company CA) curl -sv https://api.anthropic.com 2>&1 | grep -i "issuer" ``` How to read the results: | Symptom | Most likely cause | |---|---| | An HTTP status code is returned (401, 403, 404, 405) | The network layer is fine; the problem is the key or account | | `Could not resolve host` | DNS is blocked, or the proxy is not handling DNS | | `Connection timed out` / stuck at connect | The firewall does not allow 443, or the proxy is not taking effect | | `SSL certificate problem` | Corporate TLS interception; you need to configure the corporate root certificate | | curl works but the tool fails | The tool did not pick up the same environment variables, or it is using a SOCKS proxy | | Response drops midway | The proxy or firewall idle timeout is too short | On the browser side, cdnping's [online speed test](/en) shows first-connection time (including DNS and TLS handshake) and round-trip latency for both APIs, and the [IP and environment check](/en/ip) confirms your current exit IP, whether traffic is being split by routing rules, and whether DNS is leaking. For fuller steps, see the [developer network self-check list](/en/blog/developer-network-self-check-2026); if you have already confirmed a Claude Code connection error, work through the [four-layer network checklist](/en/blog/claude-code-connection-troubleshooting). ## The network is fine, but it still won't connect? Rule out a server-side outage first. cdnping probes each vendor's official API endpoints from the Cloudflare edge every 5 minutes. You can see the results on the [Claude API status](/en/status/anthropic) and [OpenAI API status](/en/status/openai) pages, and check reports from other users on [Is Claude Code down?](/en/down/claude-code) and [Is Codex down?](/en/down/codex). For reference: cdnping started collecting data on October 17, 2026. In the first window of about 85 minutes of probes (Cloudflare Denver, DEN), `api.anthropic.com` had a median of 73 ms and p95 of 84 ms, and `api.openai.com` had a median of 96 ms and p95 of 194 ms, with no failures for either. This only shows the server-side entry points look reachable from a US node. It says nothing about your own path to them, and the sample is still short. Also, according to the official status page records cdnping syncs, since September 17, 2026 the Anthropic status page has logged 6 major-level incidents, and the OpenAI status page has logged 4 major and 19 minor incidents. One of them, on October 14 (UTC), was "Degraded performance in Codex and ChatGPT Work," lasting about 167 minutes. Checking the status page first can save you a detour. To understand incident severity levels, see [How to read the OpenAI and Claude status pages](/en/blog/how-to-read-ai-status-pages). One last case has nothing to do with the network: Anthropic and OpenAI only serve supported countries and regions, and accounts or requests from unsupported regions are rejected. These errors are usually a 403 with a region-related message. For the cause and the official policy, see [Claude says your region is not supported](/en/blog/claude-unsupported-region-explained). Please follow the terms of service and local regulations, and choose a compliant way to connect.