> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/cline/cline/llms.txt
> Use this file to discover all available pages before exploring further.

# Networking and proxies

> Configure Cline to work behind corporate firewalls, proxies, and self-signed SSL certificates.

If you are working behind a corporate proxy or firewall, you need to configure proxy settings so Cline can reach AI provider APIs. The configuration method depends on which version of Cline you are using.

## VS Code extension

The VS Code extension automatically uses VS Code's built-in proxy settings. No additional Cline configuration is required.

To configure the proxy in VS Code:

1. Open VS Code **Settings** (`Cmd/Ctrl + ,`).
2. Search for `http.proxy`.
3. Enter your proxy URL (for example, `http://proxy.company.com:8080`).

For more detail, see [Network connections in Visual Studio Code](https://code.visualstudio.com/docs/setup/network#_proxy-server-support).

<Accordion title="SSL/TLS certificate errors in VS Code">
  If you see SSL certificate errors, your proxy may be performing TLS inspection with a self-signed certificate.

  **Option 1: Trust the certificate system-wide**

  Add your corporate CA certificate to the operating system trust store. VS Code picks up system certificates automatically.

  **Option 2: Relax strict SSL (not recommended for production)**

  In VS Code Settings, search for `http.proxyStrictSSL` and disable it. This bypasses certificate verification and should only be used for testing.

  **Option 3: Verify the certificate with curl**

  ```bash theme={null}
  curl -x http://proxy.company.com:8080 --cacert /path/to/ca-cert.pem -vv https://api.anthropic.com
  ```
</Accordion>

***

## Cline CLI

The Cline CLI uses standard HTTP proxy environment variables. Set these before running `cline` commands.

### Basic configuration

<CodeGroup>
  ```bash macOS/Linux theme={null}
  export https_proxy=http://proxy.company.com:8080
  export http_proxy=http://proxy.company.com:8080
  cline start
  ```

  ```cmd Windows (Command Prompt) theme={null}
  set https_proxy=http://proxy.company.com:8080
  set http_proxy=http://proxy.company.com:8080
  cline start
  ```

  ```powershell Windows (PowerShell) theme={null}
  $env:https_proxy="http://proxy.company.com:8080"
  $env:http_proxy="http://proxy.company.com:8080"
  cline start
  ```
</CodeGroup>

### Proxy with authentication

Include credentials directly in the proxy URL:

```bash theme={null}
export https_proxy=http://username:password@proxy.company.com:8080
export http_proxy=http://username:password@proxy.company.com:8080
```

<Warning>
  Storing credentials in environment variables exposes them to other processes on the same machine. Use this method only when no alternative is available, and avoid committing these values to source control.
</Warning>

### Bypass proxy for local addresses

Set `no_proxy` to prevent local traffic from being routed through the proxy:

<CodeGroup>
  ```bash macOS/Linux theme={null}
  export no_proxy=localhost,127.0.0.1,.local
  ```

  ```cmd Windows theme={null}
  set no_proxy=localhost,127.0.0.1,.local
  ```
</CodeGroup>

### Self-signed or custom CA certificates

If your proxy uses a custom certificate authority, point Node.js to the certificate file:

<CodeGroup>
  ```bash macOS/Linux theme={null}
  export NODE_EXTRA_CA_CERTS=/path/to/ca-certificate.pem
  cline start
  ```

  ```cmd Windows theme={null}
  set NODE_EXTRA_CA_CERTS=C:\path\to\ca-certificate.crt
  cline start
  ```
</CodeGroup>

The certificate file must be in PEM format.

### Permanent configuration

To avoid setting variables on every session, add them to your shell profile.

<CodeGroup>
  ```bash macOS/Linux (~/.bashrc, ~/.zshrc, or ~/.profile) theme={null}
  # Proxy configuration
  export https_proxy=http://proxy.company.com:8080
  export http_proxy=http://proxy.company.com:8080
  export no_proxy=localhost,127.0.0.1,.local
  export NODE_EXTRA_CA_CERTS=/path/to/ca-certificate.pem
  ```

  ```text Windows (System Environment Variables) theme={null}
  1. Search for "Environment Variables" in Windows Settings.
  2. Add the variables under "User variables" or "System variables".
  3. Restart your terminal or IDE.
  ```
</CodeGroup>

### Known limitations

The Cline CLI supports HTTP proxies only. The following are not supported:

* SOCKS proxies
* Proxy autoconfiguration (PAC) scripts
* Proxy authentication methods beyond basic username/password

***

## JetBrains IDEs

The JetBrains plugin uses the IDE's HTTP proxy settings.

<Steps>
  <Step title="Open Settings">
    * **Windows/Linux**: **File** > **Settings** (or `Ctrl+Alt+S`)
    * **macOS**: **IntelliJ IDEA** > **Preferences** (or `Cmd+,`)
  </Step>

  <Step title="Navigate to HTTP Proxy">
    Go to **Appearance & Behavior** > **System Settings** > **HTTP Proxy**.
  </Step>

  <Step title="Configure manual proxy">
    Select **Manual proxy configuration** and enter:

    * **Host name**: `proxy.company.com`
    * **Port number**: `8080`
    * **No proxy for**: `localhost,127.0.0.1`
    * Check **Proxy authentication** and enter credentials if required.
  </Step>

  <Step title="Test the connection">
    Click **Check connection** to verify your settings, then click **OK**.
  </Step>

  <Step title="Restart the IDE">
    Cline does not pick up proxy changes dynamically. Restart the IDE for the new settings to take effect.
  </Step>
</Steps>

<Accordion title="Custom CA certificate in JetBrains">
  If your proxy uses a custom certificate authority:

  * Add the certificate to your operating system's trust store, or
  * Import it into JetBrains: **Settings** > **Tools** > **Server Certificates** > click **+** and select your certificate file.
</Accordion>

<Note>
  The JetBrains plugin only supports HTTP proxies. SOCKS proxies and PAC scripts are not supported.
</Note>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection timeouts">
    1. Verify that the proxy address and port are correct.
    2. Check whether the proxy requires authentication.
    3. Confirm that your firewall allows outbound HTTPS traffic to the AI provider's API endpoints (for example, `api.anthropic.com`).
  </Accordion>

  <Accordion title="SSL/TLS certificate errors">
    1. Confirm that `NODE_EXTRA_CA_CERTS` points to the correct file and that the file is in PEM format.

    2. Test the certificate with curl:

       ```bash theme={null}
       curl -x http://proxy.company.com:8080 --cacert /path/to/ca-cert.pem -vv https://api.anthropic.com
       ```

    3. If using VS Code, consider disabling `http.proxyStrictSSL` temporarily to isolate the issue (not recommended for ongoing use).
  </Accordion>

  <Accordion title="Testing your proxy configuration">
    Verify that your proxy works independently of Cline using curl:

    <CodeGroup>
      ```bash macOS/Linux theme={null}
      export https_proxy=http://proxy.company.com:8080
      curl -vv https://api.anthropic.com
      ```

      ```powershell Windows (PowerShell) theme={null}
      $env:https_proxy="http://proxy.company.com:8080"
      curl.exe -vv https://api.anthropic.com
      ```
    </CodeGroup>

    Add `--cacert $NODE_EXTRA_CA_CERTS` if you need to specify a custom certificate.

    For the CLI and JetBrains plugin, check `~/.cline/cline-core-service.log` for proxy configuration details and network errors.
  </Accordion>
</AccordionGroup>

***

## Common proxy configurations

```bash theme={null}
# Authenticated HTTPS proxy with custom CA
export https_proxy=http://username:password@proxy.company.com:8080
export NODE_EXTRA_CA_CERTS=/path/to/ca-cert.pem
```

```bash theme={null}
# Unauthenticated proxy
export https_proxy=http://proxy.company.com:8080
export http_proxy=http://proxy.company.com:8080
```

```bash theme={null}
# Proxy with bypass rules for internal addresses
export https_proxy=http://proxy.company.com:8080
export no_proxy=localhost,127.0.0.1,.company.local,192.168.0.0/16
```