Web and API: Different Authentication Methods
The web app uses a browser session, while APIs typically require project credentials, organization permissions, and billing setup. Being able to chat on the website doesn’t mean API access is enabled; an API permission error doesn’t mean the browser route is failing. For troubleshooting, note the product, model, error type, and whether any response was received, then investigate each path separately.
API clients may also have separate settings for request timeouts, streaming reads, and retries. For long-running tasks, set a reasonable timeout according to the SDK documentation and consume streaming responses correctly. Don’t retry indefinitely or resend the entire request after receiving a partial response, as this can duplicate tasks or incur extra charges.
CLI: Check That Proxy Variables Are Active
Some command-line programs read HTTPS_PROXY, HTTP_PROXY, or ALL_PROXY; others require you to specify a proxy transport explicitly. The same variable name doesn’t guarantee that every runtime supports the same protocol. Check the tool’s documentation, then use the local address shown by your client.
After setting the variables, reopen the terminal and check whether a startup script overrides them. Also check whether NO_PROXY is causing requests to bypass the proxy. Don’t copy a local proxy address to a remote server: a remote process and a desktop client use different environments.
IDEs and Extensions: Identify the Host Process
Requests from Cursor or Copilot may come from the editor itself, an extension host, or a separate helper process. System proxy settings, editor settings, and extension settings may not match. After changing them, reload the app as documented, then test an actual completion or chat request—not just browser authorization.
Remote development, containers, and subsystems add more separate environments. If an extension runs remotely, check the remote network and proxy settings. For certificate errors, check the system trust store, corporate gateway, and proxy protocol. Don’t mask the issue by disabling certificate verification.
CI: Check the Runner’s Network and Credentials
CI requests originate from the runner; the VPNMC client on a developer’s computer won’t automatically affect a build. Confirm that the execution environment can reach the target service, and inject credentials through protected environment variables or a secrets manager. For managed networks, follow your organization’s proxy policies.
Keep only necessary error details in logs and redact authorization headers, project credentials, and sensitive inputs. Never commit secrets to a repository, build artifact, or public issue report. To check for network issues, compare authentication and model requests in the same execution environment instead of relying on results from a local machine.