Proxy mode quickstart

Proxy mode is for applications and tools whose base URL you can't change. They keep calling api.openai.com and the other provider hosts; the Maskflare proxy opens those connections, masks requests with the same rules as gateway mode and forwards them. It inspects TLS only for the AI provider hosts. Everything else is tunnelled untouched.

1. Connect the provider and create a key

As for gateway mode: connect the provider under AI providers and create a Gateway key under API keys. The proxy injects the stored provider key, so your application doesn't need one.

2. Trust your organization's certificate

The proxy presents certificates for the provider hosts signed by your organization's own CA. Download it from Proxy CA in the console and add it to the trust store the client uses: the system store, or the runtime's own (SSL_CERT_FILE/REQUESTS_CA_BUNDLE for Python, NODE_EXTRA_CA_CERTS for Node).

3. Point the client at the proxy

Your Maskflare key is the proxy password (with an empty user name after it):

export HTTPS_PROXY="http://mf_live_...:@YOUR_PROXY_HOST"
export NODE_EXTRA_CA_CERTS=/path/to/maskflare-ca.pem
curl -x "$HTTPS_PROXY" https://api.openai.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5-mini","messages":[{"role":"user","content":"Hello"}]}'

Clients that only send proxy credentials when challenged (PowerShell, .NET, Java, browsers) get a 407 with Proxy-Authenticate first, then retry with the key.

4. Check it worked

The request shows up under Traffic with mode proxy. A connection that can't be authenticated or inspected is refused, never passed on; the error reference lists every code, for example `proxy_auth_required` and `tls_inspection_required`.