Network and Proxy
These variables control how Claude Code reaches the network. They set the API base URL, proxies, custom certificates, timeouts, and retry counts. Use them behind a company proxy or when you route traffic through a gateway.
This page lists 68 variables. HTTPS_PROXY, NO_PROXY, and ANTHROPIC_BASE_URL are the usual ones. Project settings cannot set some endpoint variables before you trust the folder.
Example
export HTTPS_PROXY="http://proxy.example:8080"
export NO_PROXY="localhost,127.0.0.1"
export API_TIMEOUT_MS=1200000
claude
API calls go through the proxy and wait up to 20 minutes.
Variables
The table is sorted by name. See Environment Variables for what each column and badge means.
| Variable | Status | What it does | Values and default | Notes |
|---|---|---|---|---|
all_ | Undocumented: Only the program shows this item. It can change without notice. | Lower case proxy variable. It is the last fallback after HTTPS_ and ALL_ for git proxy settings. | Text. Non-empty string. Also listed with proxy names | All sessions |
ANTHROPIC_ | Documented: An official docs page names this item. | Overrides the API endpoint. A non-first-party host changes first-party checks, such as Remote Control. Since 2.1.304 tool search stays on behind a custom URL, and a 400 or 422 from the gateway is retried without it. | Text. An unset value or an Anthropic host counts as first party | All sessions. Not set from project env before trust |
ANTHROPIC_ | Documented: An official docs page names this item. | Adds custom request headers. | Text. Split on new lines, each Name: at the first colon. Claude Code drops bad header names or values with a warning | All sessions. Not set from project env before trust |
ANTHROPIC_ | Documented: An official docs page names this item. | Sends first-party API requests over this Unix socket path. | Text. Claude Code passes it as the unix fetch option. Also in the host-managed provider list with CLAUDE_ | First-party API client, all. Not set from project env before trust |
API_ | Documented: An official docs page names this item. | Forces the streaming body idle timeout on or off. | A number. A true value forces it on and a false value (0) turns the fetch timeout off | Anthropic API client, all. Not set from project env before trust |
API_ | Documented: An official docs page names this item. | Sets the API request timeout in milliseconds. | A number of milliseconds, 600000 (10 minutes) by default. Whole number. Errors show a hint to raise it | All sessions. Not set from project env before trust |
CARGO_ | Undocumented: Only the program shows this item. It can change without notice. | Names the CA bundle file for Cargo. Claude Code sets it to the sandbox CA bundle for sandboxed commands, next to SSL_ and others. | Text. Also in a list of CA env names | Sandboxed commands and remote sessions |
CLAUDE_ | Documented: An official docs page names this item. | Names the client app of an Agent SDK host. Claude Code adds it to the user agent as client-. | Text | SDK hosts. Not set from project env before trust |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Reports the Agent SDK version. Claude Code adds it to the user agent as agent-. | Text. The SDK host sets it | SDK hosts. Not set from project env before trust |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Names a gateway setting that the dispatcher did not pass to a background session. The session then prints a no-gateway hint. | Text. Active only when ANTHROPIC_ is unset. Claude Code removes it from the child env | Background sessions. Not set from project env before trust |
CLAUDE_ | Documented: An official docs page names this item. | Sets the idle timeout of the byte-level streaming watchdog. | A number of milliseconds. Whole number of 1 or more, clamped to 10000-1800000. Else a first-party default of 180000 from a feature flag | API streaming. Not set from project env before trust |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Adds the x- header to API requests. | On or off. Read when Claude Code builds the API client | API requests. Not set from project env before trust |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Gives a fallback API base URL. The Files API uses it when ANTHROPIC_ is unset. Default https://. | Text. ANTHROPIC_ wins when both are set. Credential checks also treat it as a base URL source | First-party API and Files API. Not set from project env before trust |
CLAUDE_ | Documented: An official docs page names this item. | Controls the attribution block at the start of the system prompt. A falsy value such as 0 omits it. | Text. Policy settings have a rule for it. Repo-committed settings may not re-point it | First-party API, not CLAUDE_ |
CLAUDE_ | Documented: An official docs page names this item. | Chooses the CA certificate sources for TLS. | A comma-separated list, bundled,system by default | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Gives the path of the client certificate file for mTLS. | Text. Claude Code reads the file and skips a cert and key that do not match | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Gives the path of the client private key file for mTLS. | Text. Claude Code reads the file | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Gives the passphrase of an encrypted client key. | Text. Claude Code uses it for the key check and the TLS agent | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Stops the re-read of the mTLS client cert and key after a connection-level API error. | On or off. Only matters when CLAUDE_ is set | MTLS setups |
CLAUDE_ | Documented: An official docs page names this item. | Turns off nonessential network traffic such as updates, telemetry and error reporting. | On or off | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Stops the non-streaming retry after a stream fails mid-stream. | On or off | All sessions. Project env can set it before trust |
CLAUDE_ | Documented: An official docs page names this item. Gated: Works only behind a flag or a server gate. A feature flag or server gate decides by default. This variable overrides it | Forces tool input streaming on or off. Code matches the docs. | On, off, or unset. 0 is off. Else first party needs a feature flag, Vertex and Bedrock need model support and no custom base URL, 1 forces on. Since 2. a Bedrock base URL on Amazon's own https:// host does not count as custom | All sessions. Project env can set it before trust |
CLAUDE_ | Documented: An official docs page names this item. | Merges a JSON object into the top level of every API request body. | JSON text. Ignored when org policy blocks experimental betas. Passed on to background sessions | All sessions |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Merges a JSON object into the metadata of API requests. | JSON text. Claude Code logs an error and ignores a bad value | All sessions |
CLAUDE_ | Documented: An official docs page names this item. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate | Sends or stops the gateway hint headers such as x-. | On, off, or unset. Unset sends them on some connections and else uses a feature flag on first party | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Sets the timeout of the gateway / discovery request. | A number of milliseconds, 3000 by default. Whole number from 1 to 2147483647, plain digits | Gateway setups with discovery on |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Turns gzip of CCR worker request bodies on or off. | On, off, or unset. Used only for the ccr_ source | Remote worker sessions |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Turns gzip of Datadog log batches on or off. | On, off, or unset. Unset is on only in Anthropic-hosted remote sessions (CLAUDE_ set, CLAUDE_ unset, so not BYOC), else off. If Datadog refuses a gzipped batch, gzip is off for the rest of the process | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Turns gzip of request bodies to Anthropic on or off. Set 0 for a TLS-inspecting proxy. | On, off, or unset. Compression is skipped for a proxy, mTLS, a custom CA, or a Unix socket. Level comes from CLAUDE_ | Direct Anthropic connections |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate | Sets the blocks gzip mode for large request bodies, from 524288 chars up. | A number, 0 by default. Whole number from 0 to 2, plain digits. Only 1 and 2 act | Messages API requests |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate | Sets the gzip level for request bodies. | A number, 0 by default. Whole number from 0 to 9, plain digits. Only 1 to 9 act | All API requests |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Gives the fallback HTTP proxy. Claude Code uses it to build the proxy variables of child tools when HTTP_ and http_ are empty. | Text. Fills YARN_, npm_, and GLOBAL_ proxy vars that are unset | All sessions, child process env |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Gives the fallback HTTPS proxy. Claude Code uses it to build the proxy variables of child tools when HTTPS_ and https_ are empty. | Text. Fills YARN_, npm_, and GLOBAL_ proxy vars that are unset | All sessions, child process env |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate | Builds API request bodies step by step, from the body of an earlier request. Added in 2.. | A number, 0 by default. Needs the first-party provider and the feature flag tengu_. A request with output_ set is not built this way. A body that fails a check is not used | First-party API requests |
CLAUDE_ | Documented: An official docs page names this item. | Sets how many times Claude Code retries a failed API request. | A number. Whole number, 0 or more. Claude Code clamps a value above the cap with a warning unless the retry watchdog is on | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Limits the re-sends of a non-streaming request that reaches its timeout. 0 fails on the first timeout. | A number. Whole number min 0, digits only. Unset uses a built-in count only when the retry watchdog is on | All sessions |
CLAUDE_ | Documented: An official docs page names this item. | Sets the first delay of the exponential backoff for retries of an overloaded API error. | A number of milliseconds. Whole number from 500 to 32000 in plain digits, else unset. Used only on the overloaded branch of the retry loop | All API requests |
CLAUDE_ | Documented: An official docs page names this item. | Sets the ceiling of the backoff for retries of an overloaded API error. | A number of milliseconds. Whole number from 32000 to 64000 in plain digits, else unset. A longer wait than the ceiling plus a margin raises a retry-after error | All API requests |
CLAUDE_ | Documented: An official docs page names this item. | Lets the proxy resolve DNS names. | On or off. When set the proxy agent lookup returns the host name as is | HTTP proxy setups |
CLAUDE_ | Documented: An official docs page names this item. | Retries 429 and 529 capacity errors without end for unattended sessions. Docs match the code path that reads it. | On or off. The self-hosted runner sets it to 1 and also clears CLAUDE_. Docs also cover the spend-limit rule | Unattended runs, CI, remote workers. Set by Claude Code for self-hosted runners |
CLAUDE_ | Documented: An official docs page names this item. | Lets the retry watchdog notice a usage limit that was lifted before its reset. Added in 2. (v2.1.305 release). The program logs [usage limit recheck] lines when it sends or skips a probe request. | A number of milliseconds. The program shows no format check in the strings | Sessions with CLAUDE_ |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Caps the total ms that the retry watchdog waits for usage-limit 429 errors to end. When the wait is longer than what is left, the request fails. | A number of milliseconds. Integer 1 or more, digits only. Unset means no limit | Sessions with the retry watchdog on |
CLAUDE_ | Documented: An official docs page names this item. | Caps the ms each API request spends waiting out 429 and 529 errors under the watchdog. After that the next error ends the request. | A number of milliseconds. Integer 1 or more, digits only. Unset means no limit | Sessions with CLAUDE_. Docs say v2.1.295 or later |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Narrows the retry watchdog to capacity errors. New in 2.. With capacity, the watchdog still retries 429 and 529 errors without end, but its other extensions are off: more retries after no response or a non-streaming timeout, keeping background requests on 529, and the server-error model fallback. | Text. Only capacity has an effect | Sessions with CLAUDE_ |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Holds the streamed reply of a subagent, an auxiliary, or a compaction request for up to this many ms before it passes the data on. Added in 2.. | A number of ms, 0 by default (no hold). Applies to content block delta and ping events. Held data goes on at 262144 bytes | Streaming replies of subagent, auxiliary, and compaction requests |
CLAUDE_ | Documented: An official docs page names this item. | Forces the byte-level streaming idle watchdog on or off. | On, off, or unset, on by default. Unset uses a feature flag with default true. Direct, AWS, and gateway only | Anthropic API, AWS, gateway |
CLAUDE_ | Documented: An official docs page names this item. | Enables the byte-level streaming idle watchdog for Bedrock event streams. | On or off. Off by default. Needs the main watchdog to be on | Amazon Bedrock |
CLAUDE_ | Documented: An official docs page names this item. | Forces the event-level streaming idle watchdog on or off. It also sets the async agent stall time. | On, off, or unset, on by default | All sessions |
CLAUDE_ | Undocumented: Only the program shows this item. It can change without notice. | Sets the wait before Claude Code logs a slow first byte on a stream. It does not abort. | A number of milliseconds | - |
CLAUDE_ | Documented: An official docs page names this item. | Sets the first-byte deadline of a streaming request in ms. | A number of milliseconds | - |
CLAUDE_ | Documented: An official docs page names this item. | Sets the idle timeout of the stream watchdogs in ms. | A number of milliseconds | - |
CLOUDSDK_ | Undocumented: Only the program shows this item. It can change without notice. | Names a CA bundle file for gcloud. The Bash sandbox treats it as a CA bundle variable. | A path | - |
CURL_ | Undocumented: Only the program shows this item. It can change without notice. | Names a CA bundle for curl. The Bash sandbox treats it as a CA bundle variable. | - | - |
DENO_ | Undocumented: Only the program shows this item. It can change without notice. | Names a CA bundle for Deno. The Bash sandbox treats it as a CA bundle variable. | - | - |
GIT_ | Documented: An official docs page names this item. | Gives the Git CA bundle path. Claude Code names it in CA hints and in runner messages saying a server value replaces it in a session. | Text. Use is mostly by name in text and lists | Git. Self-hosted runner. Not set from project env before trust |
HTTP_ | Documented: An official docs page names this item. | Sets the HTTP proxy for Claude Code network traffic. | - | - |
http_ | Documented: An official docs page names this item. | Lower case HTTP proxy URL. Claude Code reads it as an alternative to HTTP_. | Text. Non-empty string. Order is HTTP_, this, then CLAUDE_ for the sandbox proxy | All sessions |
HTTPS_ | Documented: An official docs page names this item. | Sets the HTTPS proxy for Claude Code network traffic. | - | - |
https_ | Documented: An official docs page names this item. | Lower case HTTPS proxy URL. Claude Code reads it as an alternative to HTTPS_. | Text. Non-empty string. Order is HTTPS_, this, then CLAUDE_ for the sandbox proxy | All sessions |
NIX_ | Undocumented: Only the program shows this item. It can change without notice. | Claude Code sets it to the CA bundle path in sandboxed commands, with other CA variables. | A path | - |
NO_ | Documented: An official docs page names this item. | Lists hosts that skip the proxy. * skips it for all. | On or off | - |
no_ | Documented: An official docs page names this item. | Lower case proxy bypass list. Claude Code reads it with NO_. | A comma-separated list. If both are set and differ, Claude Code joins them with a comma | All sessions |
NODE_ | Documented: An official docs page names this item. | Adds extra CA certificates from a PEM file to the trusted set. | - | - |
NODE_ | Documented: An official docs page names this item. | Set to 0 to turn off TLS certificate checks (Bun). Claude Code counts any value except 1 as a trust override. | - | - |
NODE_ | Undocumented: Only the program shows this item. It can change without notice. | A value other than empty or 0 makes the Bun http client use HTTP_ and HTTPS_. A bundled proxy tip names it for Node 22.21 and later. | - | - |
NODE_ | Undocumented: Only the program shows this item. It can change without notice. | The value 1 makes the Bun runtime add the OS CA store to the default CA list. | - | - |
SSL_ | Undocumented: Only the program shows this item. It can change without notice. | Gives the directory of CA certificates. Claude Code counts it as a custom CA setting. | Text. Raw string (raw). Together with NODE_ and SSL_, it makes the TLS setup treat custom certs as set | All sessions |
SSL_ | Documented: An official docs page names this item. | Gives the CA bundle file path. Claude Code treats it as a custom CA setting, and passes it to proxy helpers and the MCP agent proxy. | Text. Raw string. The MCP agent proxy fallback reads the file as PEM | All sessions |
How It Works
Claude Code reads shell variables once at startup, so restart after a change.
Claude Code reapplies values in a settings env block when the file changes.
It does not reapply them for features that read their variables only at startup.
Numeric variables such as timeouts accept forms like 2e3 and 64_000 in addition to plain digits, except where a row says digits only.
Related Pages
- Environment Variables: how Claude Code reads variables and which value wins.
- Cloud Providers
- System and Third-Party:
ALL_PROXYand CA bundle names owned by other tools. - Undocumented Items: every item that only the program shows.
Source: the program (variable names found in the 2.1.312 binary) and the Environment Variables page of the official docs.