Claude Code "Can't reach the API server" / "Connection refused": Causes and Fixes for Network, Proxy and TLS Errors (Unable to connect)
On a corporate machine or over VPN, Claude Code fails with "Can't reach the API server — check your internet or DNS (ENOTFOUND)", "Connection refused — a firewall or proxy may be blocking it (ConnectionRefused)", "SSL certificate verification failed", or "fetch failed" — network errors where the request never reached Anthropic's server (api.anthropic.com), unlike auth (401/403), server overload (529/500), and rate limiting (429). Before v2.1.227 the same errors read "Unable to connect to API (ECONNREFUSED)" with only a code. This article covers what each current message means (including No internet route, Couldn't connect through your proxy, and Connection dropped), the first-run "Unable to connect to Anthropic services" exit (checking the named proxy variable, and the possibility that your country or region isn't supported), the "Streaming response ended before any complete data was received" warning when a proxy or gateway alters the response, the three enterprise blockers (unconfigured proxy, TLS inspection, firewall) plus DNS/VPN/Docker, proxy setup (HTTPS_PROXY/HTTP_PROXY/NO_PROXY, SOCKS unsupported, NTLM/Kerberos via an LLM gateway), TLS and corporate CAs (the v2.1.273 certificate messages, the "SSL certificate error" at /login and startup, NODE_EXTRA_CA_CERTS, mTLS), why never to use NODE_TLS_REJECT_UNAUTHORIZED=0, the firewall allowlist, and a diagnostic workflow — all based on the official error reference.