# Proxy Configuration

If your network requires an HTTP proxy (common in corporate environments with SSL inspection), you can configure `tdx` to route all API requests through a proxy.

## Setting a Proxy

There are three ways to configure a proxy, listed in priority order:

**1. Global config** — Add `proxy` to `~/.config/tdx/tdx.json`:


```json
{
  "proxy": "http://proxy.corp.com:8080"
}
```

**2. Environment variable** — Set `HTTPS_PROXY` or `HTTP_PROXY`:


```bash
export HTTPS_PROXY=http://proxy.corp.com:8080
```

**3. SDK** — Pass `proxy` option when creating a TDX instance programmatically:


```typescript
const tdx = TDX.create({
  site: 'us01',
  proxy: 'http://proxy.corp.com:8080'
});
```

## Proxy with Authentication

If your proxy requires authentication, include credentials in the URL:


```json
{
  "proxy": "http://username:password@proxy.corp.com:8080"
}
```

Credentials are automatically masked in logs and error messages.

## Resolution Order

When tdx needs a proxy, it checks these sources in order:

1. **SDK `proxy` option** (programmatic use only)
2. **Global config** — `proxy` field in `~/.config/tdx/tdx.json`
3. **`HTTPS_PROXY`** environment variable
4. **`HTTP_PROXY`** environment variable


## Verifying Proxy Configuration

Use `--debug` to confirm proxy is being used:


```bash
tdx --debug databases
# Look for "Using HTTP proxy: http://proxy.corp.com:8080" in output
```

## Troubleshooting

| Error | Cause | Fix |
|  --- | --- | --- |
| `PROXY_CONNECTION_FAILURE` | Cannot reach the proxy server | Verify proxy URL and that the proxy is running |
| `407 Proxy Authentication Required` | Proxy credentials are wrong or missing | Add or fix `username:password@` in the proxy URL |
| `ECONNREFUSED` | Target server unreachable (not a proxy issue) | Check your network or TD API endpoint |