Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Commands and people using an environment can read ordinary environment variables; the proxy attaches network secrets to matching outbound requests.
- Network secrets require an eligible Anthropic-hosted cloud environment and an API reachable from the public internet.
- GitHub, the Anthropic API, public package registries, setup-script requests, and telemetry do not receive network secrets.
- Archiving affects new sessions, while existing sessions keep running with the environment's secrets until you delete them.
- When setup finishes in roughly five minutes, a filesystem snapshot can be reused; running databases and other processes are not preserved.
First check which environment runs the session
Claude Code cloud-environment settings apply to cloud sessions. The current documentation lists Pro, Max, Ultra, and Team, plus Enterprise users with premium seats or Chat + Claude Code seats. Remote Control connects a browser or phone to a session on your own computer; a self-hosted environment uses your own runner and network boundary. Do not apply the network-secret behavior for Anthropic-hosted cloud environments to either one.
Network secrets have additional requirements. The environment must already exist and be Anthropic-hosted, and the API must accept connections from the public internet because requests leave from Anthropic's network. Organizations using customer-managed encryption keys cannot save these secrets. So do not turn “cloud sessions are on this plan” into “every account and environment can add a secret.” Check the seat, environment type, and organization settings first.
Environment variables and network secrets are different
Environment variables enter a cloud session as ordinary variables, which commands and people using that environment can generally read. OTEL_* variables are an exception: Claude Code uses them for telemetry export and does not pass them to commands it runs. Ordinary variables suit non-sensitive settings such as a runtime mode or log level, not API tokens. Putting a key in a variable, repository file, or setup script does not give it the isolation of a network secret.
A network secret is stored on the environment. Anthropic's agent proxy adds it to a request after that request leaves the session VM, and only for the hosts listed on the secret. The documentation says the key itself does not appear in the session's environment variables or files; after saving, you cannot view its value again. This can keep a raw token out of command arguments and project files for API-calling workflows, but the allowed host scope still needs to be narrow.
Host matching grants a request path, with explicit exclusions
The proxy attaches a secret when the request host matches one allowed on that secret. Every session in the environment can use it, whoever started the session, until the secret is deleted. A listed host can be reachable through the agent proxy even when the environment's network-access level would not otherwise allow it. Enter the API's actual host and use a subdomain wildcard only when needed; do not widen the domain scope for convenience.
Several request types never receive a network secret. GitHub APIs use the separate GitHub proxy. The Anthropic API and public package registries such as npm, PyPI, and crates.io are excluded. A setup script runs before Claude Code starts and connects to the agent proxy, and telemetry also does not pass through that proxy. So do not expect a saved secret to authenticate a private dependency-install script. The docs also say environment variables are not set yet while a setup script runs.
Add, rotate, and revoke before archiving
Before adding a secret, confirm the API host and required authentication header. Add one item under Network secrets for the environment. For an API that accepts a Bearer token, the default type and Authorization header may fit; use the header name the API documents when it requires something else. A shorter member form accepts one host at a time and does not allow wildcards. On Team and Enterprise, an Owner manages secrets for a shared environment; the available form depends on your role.
The saved value cannot be shown again. To change its value or host scope, the docs say to delete the old item and add it again. Archiving prevents new sessions from selecting the environment, but sessions already running continue, and the environment's secrets stay attached to them. If you are archiving to stop access, delete any secret you no longer want first. Archiving is not a substitute for deleting a secret.
A dependency cache stores files, not live services
If a hosted environment's setup script finishes within roughly five minutes, Anthropic snapshots the filesystem for reuse. Later new sessions can start with dependencies, tools, container images, and written files already on disk, skipping setup. A setup script that exceeds that window is not cached. This is reusable environment preparation, not a development container that stays running.
A database, docker compose service, or other running process does not keep running because it was in the snapshot; start it again in the session when needed. Setup runs again to rebuild the cache when you change the setup script or allowed network hosts, or when the cache expires after roughly seven days. If you need a configuration change right away, run the necessary steps in the current session or start a new one. Do not assume an already-running process has restarted or picked up a new setting.
Check the configuration with a request that uses no sensitive data
For example, suppose you want Claude Code to call the publicly reachable api.example.com. Select an Anthropic-hosted cloud environment, confirm that the exact API host is listed on the network secret, check the secret type and your organization's permissions, then use a test endpoint that neither returns personal information nor writes data. When reviewing the result, record only the request host, status code, and a redacted error. Keep the token, full response, and personal data out of logs.
This is a preflight checklist, not a cloud-session test performed for this guide. Before verifying, confirm which environment is selected, which host receives the secret, whether the request came from a Claude session or a setup script, and whether it falls into an exception such as GitHub or a public package registry. If the result differs from expectations, trace the request path before deciding whether to delete and re-add the secret.
Sources
Frequently Asked Questions
Why can an Admin not open the shared cloud-environment management page?
For Team and Enterprise, the Owner role has the organization admin access required here; the Admin role cannot open the Cloud environments admin page. Members can still manage secrets on their own environments. An Owner manages shared-environment secrets in admin settings.
Will a package installed during a session be cached for the next session?
No. The documentation says packages installed during a session do not carry over to other sessions. Put reusable dependencies in the setup script and keep that script within the caching requirements.
What should I check first when a secret is marked Not sent?
Read the note under that item first: it explains why the secret was not sent and what to do next. Check the selected environment, destination host, and request path; do not treat a wider host scope as the default fix.