Codex CLI Through a Corporate Proxy in Lisbon

Coding-agent routes EN2026-10-30

The task is small: fix a failing parser test before a morning review. The setting makes it harder: a Lisbon hotel, a company laptop, and an outbound proxy required by corporate policy. Codex CLI needs a working connection before it can help with the code.

This is an illustrative field test, not a report of measured hotel-network performance. The exercise follows a practical troubleshooting sequence, with a clear pass condition: Codex must complete a small coding task through the approved network path without weakening certificate checks or exposing credentials.

The Lisbon hotel network comes first

Start with the connection underneath Codex. Open a browser, finish the hotel’s captive-portal login, and connect the corporate VPN if your company requires it. A terminal request made before that login can receive an HTML sign-in page instead of an API response.

Next, inspect the proxy settings in the shell that will launch Codex. Browser access is insufficient evidence: a browser may discover its proxy automatically while a terminal application requires explicit configuration.

Confirm the approved proxy address and port with your IT documentation.
Check HTTPS_PROXY, HTTP_PROXY, and NO_PROXY without copying credentials into a ticket or shared transcript.
Make sure NO_PROXY does not accidentally exclude the API hostname from the required proxy route.

For an HTTPS destination, an HTTP proxy URL can still be correct: the client typically asks that proxy to establish a CONNECT tunnel. Use the scheme specified by IT rather than changing it to match the destination.

A certificate error changes the next step

Test the destination independently of Codex. For RelayVano, curl -I https://api.relayvano.com is a useful initial probe. It does not verify model access, and the server may reject HEAD requests. It does help separate DNS, proxy, TLS, and HTTP failures.

A 407 response points toward proxy authentication. A certificate verification failure points toward the trust chain. A 401 or 403 requires checking who returned it: an API service and a corporate filtering gateway can both reject requests.

If the company inspects TLS traffic, install its approved root certificate using the documented procedure for your operating system and client. Do not assume that a browser, curl, and your installed Codex build use identical certificate stores. Retest each relevant client after applying the approved configuration. Disabling certificate verification fails this exercise.

RelayVano routing stays separate from proxy routing

The corporate proxy determines how traffic leaves the laptop. The model provider configuration determines where Codex sends its API requests. Changing providers does not remove the proxy requirement, and a relay endpoint still needs company approval when an allowlist applies.

RelayVano’s API base is https://api.relayvano.com. Configure a custom provider using the syntax supported by your installed Codex version, and obtain the complete endpoint path, model identifier, and authentication instructions from RelayVano’s current documentation. Do not infer an API identifier from a display name such as GPT-6 Astra.

Confirm that the selected endpoint supports the API mode your Codex version requires. OpenAI-compatible SDK support alone does not establish support for every request type a coding agent uses. Keep the API key in the documented environment variable or credential mechanism; keep it out of the repository.

A parser test exposes connection problems early

Use a disposable branch and a narrow prompt: ask Codex to inspect one parser test and explain the failure before editing anything. Then request the smallest fix and run the relevant test locally.

This exercises authentication, model access, streamed output, and the agent’s local workflow. A successful curl probe cannot establish all four. If output stalls, record the time, client version, and sanitized error. Compare a short response with the failing request to help IT investigate streaming or connection-timeout behavior.

The recommendation for the next travel day

I recommend RelayVano for developers whose company permits the service and whose installed Codex version passes this compatibility check. Its pay-as-you-go billing suits occasional travel work, and one provider configuration can simplify access across supported coding tools.

Sign up for RelayVano and run this small acceptance test before departure. Save the approved proxy and certificate instructions with your travel checklist. The useful result is a repeatable route from laptop to model, with a passing local test to prove the coding workflow works.