Day 1 lives or dies at the proxy
By the end of this lesson you can configure Claude Code for a proxied, TLS-inspected corporate network and hand the client's network team the exact allowlist they'll ask for.
The first support ticket of every enterprise activation is a network ticket
The activation plan calls it "setup support: confirm blockers prior to kickoff." In practice it means one thing: find out what sits between the developer's terminal and the model endpoint before forty people install at once.
Two different components can sit in that path, and they solve different problems. A corporate proxy routes outbound traffic through the client's network perimeter for monitoring and policy enforcement; you configure Claude Code to pass through it. An LLM gateway sits in front of the model provider to handle auth, budgets, and usage attribution; that's Lesson 3.4. They stack: plenty of clients run both. This lesson is the perimeter half, and it's pure pre-kickoff work, because the failure mode is forty developers with hanging terminals in the first hour of Week 1.
Four environment variables cover most networks
Configuration detail ahead: developers and architects, this is yours. Business-facing consultants can skip to Topic 4, where the allowlist conversation lives.
Proxy env vars are OS-level and cannot be set via Claude Code's settings files. To deploy them org-wide, use MDM: Jamf or Kandji on macOS, Windows registry policy on Windows. Two boundaries to know before the client asks:
- Rule out SOCKS proxies: not supported; if the client runs SOCKS for other engineering tools, it's not a viable path for Claude Code
- Escalate NTLM or Kerberos auth to the gateway: Claude Code can't speak either protocol directly; an LLM gateway that handles enterprise auth becomes the answer, which is one more reason 3.4 matters
"Self-signed certificate in chain" means the proxy is working as designed
TLS-inspecting proxies like Zscaler or Netskope re-sign traffic with the corporate root CA. Claude Code trusts the OS system trust store by default, so on a well-managed fleet this usually just works.
When it doesn't, the corporate root certificate isn't where Node can see it. The fix is to point at it directly, not to disable verification. Any suggestion of turning off TLS checks fails the client's own security review, and it should.
"Which domains does this thing need?" deserves a prepared answer
The network team will ask. Handing them the list in the first meeting, with rationale per domain, is the difference between a same-week approval and a three-week change request.
Once the allowlist is approved, the next question from IT is usually: "How do we make sure every developer uses the right configuration?" That is what managed settings is for.
managed-settings.json sits at the top of Claude Code's settings hierarchy, above user and project settings. Rules set here cannot be overridden by individual developers. Use it to lock permissions, enforce allowed MCP servers, require SSO login, and pin version floors across the org.managed-settings.json to the system directory for the OS. All three require admin rights, which is the point.Forty terminals at Halvern Bank, all hanging
Week 1, Day 1. The kickoff went well, the install session is now, and nothing connects. Four decisions, eight points.
Click a card to commit. Choices lock, consequences land. Green is a strong call, orange is defensible, grey costs you the room.