**[BUG] Claude Desktop (Electron) returns HTTP 403 from claude.ai behind corporate explicit proxy — PAC-based network, macOS

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Desktop v1.4758.0 (Electron 41.3.0) on macOS cannot connect to claude.ai
from a corporate network that uses an explicit forward proxy via PAC file.

The app displays:
"Couldn't connect to Claude / check your network connection"

Browser access to claude.ai from the same machine and network works correctly.
All proxy and firewall tests confirm the network is not the issue — the block
originates from Cloudflare returning HTTP 403 for the Electron client.

Environment:

• OS: macOS (Apple Silicon, MDM managed)
• Claude Desktop: v1.4758.0 (Electron 41.3.0)
• Proxy type: Explicit forward proxy via PAC file
• PAC file: http://proxy.corp.internal:8083/files/proxy.pac
• Proxy server: proxy.corp.internal:8080
• TLS inspection: None — Let's Encrypt certificate verified OK end-to-end
• Same app on Windows corporate machine: works correctly

What Should Happen?

Claude Desktop should connect to claude.ai successfully on corporate networks
that use explicit forward proxies, the same way a standard browser does.

Confirmed working on the same network:

• Browser (Chrome/Edge) → claude.ai → HTTP 200 ✓
• Claude Desktop on Windows (same corporate network) → works ✓
• curl → api.anthropic.com via proxy → HTTP 200 ✓

Expected: Claude Desktop on macOS connects and loads normally.
Actual: "Couldn't connect to Claude" — Cloudflare returns HTTP 403
for the Electron client regardless of proxy configuration.

Error Messages/Logs

Test 1 — api.anthropic.com is reachable through proxy (network is not blocked):

  $ curl -v --proxy http://proxy.corp.internal:8080 \
      https://api.anthropic.com/v1/models \
      -H "x-api-key: test"

  * Connected to proxy.corp.internal port 8080
  < HTTP/1.0 200 Connection Established
  * SSL connection using TLSv1.3
  * issuer: C=US; O=Let's Encrypt; CN=E8
  ← API endpoint reachable, no TLS inspection

---

Test 2 — claude.ai is reachable directly (PAC returns DIRECT for claude.ai):

  $ curl -v https://claude.ai

  * Connected to claude.ai (160.79.104.10) port 443
  * issuer: C=US; O=Let's Encrypt; CN=E8
  * SSL certificate verify ok.
  ← Real Let's Encrypt cert confirmed, no corporate MITM

---

Test 3 — Cloudflare returns HTTP 403 for Electron User-Agent (root cause):

  $ curl -v --proxy http://proxy.corp.internal:8080 \
      -H "User-Agent: Mozilla/5.0 Claude/1.4758.0 Electron/41.3.0" \
      https://claude.ai

  * Connected to proxy.corp.internal port 8080
  < HTTP/1.0 200 Connection Established   ← proxy tunnel OK
  * SSL connection using TLSv1.3
  * issuer: C=US; O=Let's Encrypt; CN=E8  ← real cert, no MITM
  < HTTP/2 403                            ← Cloudflare blocks Electron

---

Test 4 — Confirmed env var and Chromium flag set correctly, still HTTP 403:

  $ launchctl getenv HTTPS_PROXY
  http://proxy.corp.internal:8080         ← env var confirmed

  $ ps aux | grep Claude | grep proxy
  ... Claude --proxy-server=http://proxy.corp.internal:8080 ...
                                          ← Chromium flag confirmed in process

  Result: "Couldn't connect" persists — HTTP 403 regardless of proxy routing

Steps to Reproduce

1. Install Claude Desktop v1.4758.0 on macOS (Apple Silicon)

behind a corporate explicit proxy using a PAC file

1. Confirm browser access works:

curl https://claude.ai → HTTP 200 with browser User-Agent

1. Confirm api.anthropic.com is reachable via proxy:

curl --proxy http://proxy.corp.internal:8080 https://api.anthropic.com → 200

1. Launch Claude Desktop → "Couldn't connect to Claude"

1. Set proxy env var and relaunch:

launchctl setenv HTTPS_PROXY http://proxy.corp.internal:8080
open -a "Claude"
→ still "Couldn't connect"

1. Launch with Chromium proxy flag:

/Applications/Claude.app/Contents/MacOS/Claude \
--proxy-server="http://proxy.corp.internal:8080"
→ confirm flag in process via ps aux
→ still HTTP 403 from Cloudflare

1. Reproduce Cloudflare block directly:

curl --proxy http://proxy.corp.internal:8080 \
-H "User-Agent: Mozilla/5.0 Claude/1.4758.0 Electron/41.3.0" \
https://claude.ai
→ HTTP/2 403

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.119 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

Key observations:

1. Windows is NOT affected — same corporate network, same proxy,

Claude Desktop on Windows connects successfully.
This suggests the issue is macOS-specific in how Electron
resolves the PAC file or presents its TLS fingerprint to Cloudflare.

1. No TLS inspection is in place — all certificates are genuine

Let's Encrypt, confirmed by issuer field in all curl tests.
This rules out Corporate Root CA issues.

1. All client-side workarounds attempted and failed:

• launchctl setenv HTTPS_PROXY → env confirmed set, still 403
• --proxy-server Chromium flag → confirmed in process, still 403
• open -a "Claude" --args --proxy-server=... → still 403

1. Business impact: Claude Desktop is completely unusable for all

macOS users on this corporate network. There is no client-side
workaround available. Browser-based claude.ai access works but
cannot substitute for Desktop-specific features.

Related issues:

• #30318 — macOS proxy/403 (different root cause: proxy not set)
• #45994 — CoWork VM proxy inheritance
• #32668 — Feature: Bedrock backend for Desktop (proposed workaround)