HTTP Proxy
Corporate networks often require an HTTP(S) proxy between NVM for Windows and the internet. The proxy applies to download traffic: Node.js archives, catalogs, and related HTTPS calls. It is separate from Download Mirrors, which set where archives come from.
Community Builds and Certified Builds support a basic proxy URL. Basic and Bearer auth are Certified Builds paths. IWA (NTLM/Negotiate) and PAC/WPAD need the Governance add-on.
Resolve order
- Explicit
proxy/Proxysetting (policy or config) - Process environment (
HTTP_PROXY,HTTPS_PROXY, and related variables) - Internet Explorer / WinINET system proxy settings
Configuration
| Config | Registry | Notes |
|---|---|---|
proxy | Proxy | Proxy URL, e.g. http://proxy.example.corp:8080 |
proxy_auth | ProxyAuth | user:pass or Bearer YOUR_TOKEN — stored in plain text |
proxy_auth_type | ProxyAuthType | basic, bearer, ntlm, negotiate, or ntlm,negotiate |
nvm config set proxy=http://proxy.example.corp:8080
nvm config get proxy
On Certified Builds fleets, set proxy keys with machine policy. See Registry Policy Reference.
Capabilities by license
| Capability | Community Builds | Certified Builds | Governance |
|---|---|---|---|
| Proxy URL | ✓ | ✓ | ✓ |
| Basic/Bearer auth | limited* | ✓ | ✓ |
| IWA (NTLM/Negotiate, current user) | ❌ | ❌ | ✓ |
| PAC/WPAD (WinHTTP) | ❌ | ❌ | ✓ |
*Community Builds may embed credentials in the proxy URL. Dedicated ProxyAuth* injection is a Certified Builds path.
ProxyAuth is plain text under policy and preferences. Use IWA (ntlm / negotiate) when regulations disallow stored passwords.
Digest auth is not supported. Requirements are large and real-world use is rare.
NVM for Windows has no interactive SAML/OIDC browser login for captive portals. Use PAC when that is the corporate path.
Related
- Download Mirrors — Node.js and npm registry URLs
- Author Mirror — Governance policy-aware download host
- Basic Configuration —
proxypreference - Registry Policy Reference —
Proxy,ProxyAuth,ProxyAuthType - Governance — IWA and PAC/WPAD
- Enterprise requirements — outbound allow-lists