Configure proxy, certificates, DNS, and browser behavior for Qoder CLI
Qoder CLI requires network access to perform operations such as authentication, model inference, web search, and web scraping. In corporate intranets, proxy environments, or restricted networks, you may need to configure a proxy, certificates, or custom DNS behavior. This page covers the relevant environment variables and configuration methods.Most network settings are controlled via standard environment variables, so you can directly apply your existing terminal network configuration practices.
Proxies are read at startup; you must restart Qoder CLI after making changes.
Both uppercase and lowercase forms (e.g., HTTPS_PROXY and https_proxy) are recognized, though some tools require the lowercase form.
When the sandbox is enabled, proxy settings are forwarded to the sandbox environment, ensuring that requests from within the sandbox also route through the proxy.
In networks using self-signed certificates or enterprise root certificates, you can specify additional trusted certificates via standard Node.js environment variables:
Variable
Description
NODE_EXTRA_CA_CERTS
The path to an additional CA certificate file (in PEM format).
If you encounter certificate validation failures (such as unable to verify the first certificate), you typically need to configure the above variables to point to the correct root certificate.
For environments with specific requirements for DNS resolution order, you can use the advanced.dnsResolutionOrder configuration item to specify the resolution order (e.g., prioritizing IPv4 or following the system's return order). A restart is required after modifying this setting.
By default, processes such as sign-in and authentication attempt to open a browser to complete the callback. The CLI automatically detects environments without a graphical interface and skips launching the browser, printing a link you can copy manually instead—an environment is treated as having no graphical interface if any of the following conditions is met:
CI is set;
BROWSER=www-browser;
DEBIAN_FRONTEND=noninteractive;
inside an SSH session (SSH_CONNECTION);
on Linux with none of DISPLAY, WAYLAND_DISPLAY, or MIR_SOCKET set.
Therefore, no extra configuration is needed in SSH remote sessions, containers, or CI environments. For more details on authentication, see Sign-in and Authentication.
When the sandbox is enabled, network access is disabled by default (tools.sandboxNetworkAccess defaults to false). If you need network access within the sandbox, you must explicitly enable this option. Proxy-related environment variables are forwarded into the sandbox. For more details on sandbox network isolation, see Sandbox.
Connection timeouts or inaccessible resources: Verify that the proxy variables are set correctly and that NO_PROXY does not omit any necessary intranet domains.
Certificate errors: Configure NODE_EXTRA_CA_CERTS to point to the enterprise root certificate.
Browser fails to open during sign-in: In environments without a graphical interface, the CLI automatically skips launching the browser and prints the sign-in link; manually copy it into a browser to open it. You can also switch to Personal Access Token authentication instead.
