›_ Codex Issues
Codex Issues / #6060

Support configuring outbound HTTP proxy via http_proxy in config.toml

Open 💬 14 comments Opened Oct 31, 2025 by ibakaidov
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What feature would you like to see?

# Support configuring outbound HTTP proxy via http_proxy in config.toml

🧭 Background & Motivation

Many enterprise and academic environments route outbound traffic through HTTP proxies (Zscaler, explicit/PAC proxies, on-prem egress).
Codex currently lacks first-class proxy support, leading to:

  • Unpredictable network request failures in CI/CD and sandboxed setups
  • Divergence between local runs (no proxy) and pipeline runs (behind proxy)
  • Fragile, undocumented workarounds (manual export HTTP_PROXY, wrapper scripts)

A prior PR (#4261) proposed adding proxy support via configuration, but was closed since the project isn’t generally accepting new features right now.
This issue tracks that enhancement for community discussion and roadmap consideration.

---

✅ Proposal

Introduce an optional http_proxy field in the Codex configuration that, when set, is forwarded to the process environment variable HTTP_PROXY before the HTTP client initializes.

Key elements

  • Config: http_proxy in config.toml and profiles
  • Startup: On process startup, if set, propagate http_proxy → HTTP_PROXY
  • Docs: Add a ## http_proxy section in docs/config.md with examples
  • Tests: Unit test asserting that http_proxy in config sets HTTP_PROXY at runtime

These elements mirror what was proposed in PR #4261, with ~60 new lines across:

  • codex-rs/core/src/config.rs
  • codex-rs/core/src/config_profile.rs
  • docs/config.md

---

🔒 Security & Operational Notes

  • Propagation occurs before worker threads spawn → race-free
  • Proxy value should not be logged or echoed in errors (avoid secret leakage)
  • In sandboxed environments, proxies remain ineffective by design — should be documented

---

🔁 Backward Compatibility

  • http_proxy is optional; if unset, behavior is unchanged
  • No breaking changes to public APIs or CLI behavior

---

🔄 Alternatives Considered

  1. Rely only on system env vars — brittle and inconsistent across CI vs local
  2. Per-request proxy control — overly granular for a first iteration
  3. PAC/auto-detection — platform-dependent, can be added later

---

🧪 Testing Strategy

  • Unit: Validate that http_proxy in config sets HTTP_PROXY
  • Integration: Verify outbound requests route through the configured proxy
  • Regression: Ensure unchanged behavior when http_proxy is absent

---

📝 Documentation Snippet

# ~/.config/codex/config.toml
http_proxy = "http://localhost:8080"

Include notes on precedence (Profile → Base Config → Defaults) and known sandbox limitations.

---

📣 Community Feedback Requested

  • Does a global HTTP_PROXY propagation meet your needs, or do you require per-service granularity?
  • Should NO_PROXY or authenticated proxies be supported in v1?

---

🏷️ Labels

enhancement config networking proxy

Additional information

_No response_

View original on GitHub ↗

14 Comments

github-actions[bot] contributor · 8 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #4242

Powered by Codex Action

gaby · 7 months ago

The following should be configurable:

  • http_proxy
  • https_proxy
  • no_proxy
  • all_proxy
shelper · 3 months ago

i also want this, without this cannot use codex on corp PC

zhpencil · 3 months ago

Me too. I think socks5 proxy is also an necessary.

bg51717 · 3 months ago

You could write the HTTP proxy in ~/.codex/.env.
Such as

https_proxy="http://127.0.0.1:7890" 
http_proxy="http://127.0.0.1:7890"
all_proxy="socks5://127.0.0.1:7891"
631068264 · 3 months ago

I hope the proxy config can work in sandbox , if my code need proxy

zhpencil · 2 months ago

Thanks for the replay.
It's very helpful.
I would have a try.

wyx @.***> 于2026年4月21日周二 10:41写道：

631068264 left a comment (openai/codex#6060) <https://github.com/openai/codex/issues/6060#issuecomment-4285585136> I hope the proxy config can work in sandbox , if my code need proxy — Reply to this email directly, view it on GitHub <https://github.com/openai/codex/issues/6060?email_source=notifications&email_token=AJKYSTU3LBAIVY2ILPIUGOD4W3NUTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMRYGU2TQNJRGM3KM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4285585136>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJKYSTQ366VTQ6MPAP3IL7D4W3NUTAVCNFSM6AAAAACK2G2MZ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DEOBVGU4DKMJTGY> . You are receiving this because you commented.Message ID: @.***>
agi4xyz · 2 months ago
You could write the HTTP proxy in ~/.codex/.env. Such as `` https_proxy="http://127.0.0.1:7890" http_proxy="http://127.0.0.1:7890" all_proxy="socks5://127.0.0.1:7891" ``

It works, thanks a lot.

Saltsmart · 1 month ago

<img width="1217" height="1144" alt="Image" src="https://github.com/user-attachments/assets/958f4e5f-ab7e-47f0-bac6-787fd82ceec2" />

You could write the HTTP proxy in ~/.codex/.env. Such as `` https_proxy="http://127.0.0.1:7890" http_proxy="http://127.0.0.1:7890" all_proxy="socks5://127.0.0.1:7891" ``

Does codex read .env file on Windows?
I doubt it's not set yet.

xxxifan · 1 month ago

please fix this, we need it.

oneAI6 · 1 month ago

For Windows users trying to determine whether proxy environment variables are actually visible, and whether they conflict with Windows user proxy or WinHTTP settings, I maintain a small read-only diagnostic CLI called proxy-path-doctor:

python -m pip install proxy-path-doctor
proxy-path-doctor

It reports HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY alongside Windows user proxy and WinHTTP proxy state, with credentials redacted. It does not configure Codex or solve the missing first-class proxy setting, but it may help affected users produce a clearer environment report without guessing which proxy source is active. Please review output before sharing because proxy addresses may still be sensitive.

icyblazek · 25 days ago

A simple solution: https://github.com/icyblazek/codex-gui-proxy
support codex gui app

DLakomy · 25 days ago

In case of macOS, it's also possible to run Codex GUI app like this:

export https_proxy=...
codex app

The running instance should correctly use the proxy set in the env.

oneyoung19 · 19 days ago
You could write the HTTP proxy in ~/.codex/.env. Such as `` https_proxy="http://127.0.0.1:7890" http_proxy="http://127.0.0.1:7890" all_proxy="socks5://127.0.0.1:7891" ``

Maybe it does not work today at Version 26.623.81905 • Released Jul 1, 2026.