Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The official OpenAI Codex repository lists version 0.164.0 as a release dated 2026-10-23.
- Its release notes say Windows HTTPS and WebSocket connections can now answer proxy authentication challenges with the signed-in Windows user's Negotiate or NTLM credentials.
- The related merged changes address CONNECT responses with 407; this describes Codex request handling, not universal support across applications, systems, or proxy protocols.
- The merged helper notes one limitation: it does not support HTTPS proxies that require authentication tokens bound to the TLS connection.
- If 407 persists, confirm the running version and proxy authentication method with your organization's network administrator; do not share Windows credentials or evade policy.
What changed in 0.164.0?
The official OpenAI Codex repository dates its 0.164.0 release to 2026-10-23. The release notes say Windows HTTPS and WebSocket connections can now handle proxy authentication challenges using the signed-in Windows user's Negotiate or NTLM credentials.
This helps Windows users who access Codex through a corporate or managed proxy: when the proxy returns 407 to a CONNECT request that opens an HTTPS tunnel, the updated client has a new integrated-authentication path. The release page does not say that this changes Codex plan access, regional eligibility, or proxy policy.
What do Negotiate and NTLM mean here?
They are integrated authentication methods a proxy can require. The related merged changes say Codex's Windows helper connection uses the signed-in Windows user's Negotiate or NTLM identity to handle a CONNECT 407; the notes do not ask readers to paste a Windows password into a proxy URL or chat.
This describes Codex's own Windows request path. It does not establish that a browser, another command-line tool, macOS, Linux, or any custom program will use the same credentials or have the same proxy capability.
Which proxy and request scope is documented?
The release notes explicitly name HTTPS and WebSocket connections on Windows. The related helper's merge description says it can handle HTTP or HTTPS proxy endpoints, but that does not mean Codex supports every proxy protocol or establish SOCKS support.
The helper's merge description also says it does not support HTTPS proxies that require authentication tokens bound to the TLS connection. The public release notes do not provide a complete matrix for other authentication methods, unusual proxy deployments, or compatible versions; check with your organization's network administrator and later official notes.
What should Windows users check first?
Confirm that the running Codex CLI installation is actually version 0.164.0 or a later version that includes the change, rather than assuming it is installed because a release page exists. Then ask your organization's administrator whether the proxy requires Negotiate or NTLM and whether your Windows user is authorized to use it.
This is a client connection-handling change. It does not grant network access or alter a destination service's account eligibility or regional rules. Do not disable TLS verification, export Windows authentication material, or post real accounts, passwords, or full proxy addresses in public questions.
What if 407 continues after updating?
First confirm that the error comes from the proxy during CONNECT, then record the Codex version, Windows environment, and authentication method required by the proxy. If the proxy requires a connection-bound token, the helper description says that mode is unsupported; for other causes ask your network administrator to check organizational policy and proxy logs.
Do not switch to an unapproved network exit to evade organizational controls. For general 407, 401, TLS, and timeout layers, see the proxy connection troubleshooting checklist; it cannot replace your organization's confirmation of its enterprise proxy.
Sources
Frequently Asked Questions
Which Codex CLI version adds Windows Negotiate/NTLM proxy authentication?
The official OpenAI Codex repository's version 0.164.0 release page lists the update and is dated 2026-10-23. Confirm the version actually running, not just that a newer release exists.
Does the update put my Windows password in the proxy URL?
The release page and related merged changes describe using the signed-in Windows user's Negotiate or NTLM credentials; they do not ask you to put a Windows password in the proxy URL. Do not share credentials with others or post them in public questions.
Does it support every proxy or every Codex platform?
Do not infer that. The release notes cover HTTPS and WebSocket connections on Windows; the related helper notes HTTP/HTTPS proxy endpoints, but does not establish SOCKS support or support for all other applications and systems.
Will 0.164.0 always fix 407 with a TLS-bound HTTPS proxy token?
No. The related merged Windows proxy-authentication helper description explicitly says it does not support HTTPS proxies whose authentication tokens are bound to the TLS connection.
Does proxy authentication bypass company network rules or Codex eligibility?
No. It improves authentication handling for a specific Windows request path. It does not grant network access or change service-side account eligibility, plans, or regional rules.