PowerShell Proxy Settings: Configure and Bypass Proxy
─□✕

PowerShell Proxy Settings: Configure and Bypass Proxy

PowerShell Tips Editor 4 min read
PowerShell Proxy Settings: Configure and Bypass Proxy

Behind a corporate firewall, Invoke-WebRequest and Invoke-RestMethod fail silently or return cryptic connection errors that have nothing to do with the target URL. The culprit is almost always PowerShell proxy settings — the session is not routing through the corporate proxy, or the proxy requires credentials your script never supplies. This post shows you exactly how to configure, authenticate, and bypass proxies for PowerShell web requests.

Quick Answer / TL;DR

Add -Proxy http://proxy.corp.com:8080 -ProxyUseDefaultCredentials to Invoke-WebRequest or Invoke-RestMethod. For no proxy on internal URLs, add -NoProxy (PS7) or set -Proxy ''.

Use System Default Proxy

Windows stores the system proxy in Internet Explorer / WinHTTP settings. PowerShell 5.1’s web cmdlets do not use the system proxy automatically for all scenarios. Adding -UseDefaultCredentials passes your current Windows credentials to the proxy, which handles NTLM/Kerberos-authenticated proxies common in corporate environments.

# Use the system-configured proxy with current Windows credentials
Invoke-WebRequest -Uri 'https://api.example.com/data' -UseDefaultCredentials

# Equivalent for Invoke-RestMethod
$response = Invoke-RestMethod -Uri 'https://api.example.com/v1/users' -UseDefaultCredentials

Specify Proxy with -Proxy Parameter

When the system proxy differs from what you need, or when running under a service account that has no system proxy configured, specify the proxy address explicitly with -Proxy. The value must be a URI string including the scheme and port.

$proxyUri = 'http://proxy.corp.example.com:8080'

Invoke-WebRequest -Uri 'https://api.github.com' -Proxy $proxyUri

# With Invoke-RestMethod
$result = Invoke-RestMethod `
    -Uri 'https://api.github.com/repos/PowerShell/PowerShell' `
    -Proxy $proxyUri

Proxy Authentication with -ProxyCredential

When the proxy requires explicit username/password (not Windows SSO), supply a PSCredential object via -ProxyCredential. Build the credential object with Get-Credential for interactive scripts or from a secure file for automation.

# Interactive credential prompt
$proxyCred = Get-Credential -Message 'Proxy credentials'

Invoke-WebRequest -Uri 'https://external.api.com' `
    -Proxy 'http://proxy.corp.example.com:8080' `
    -ProxyCredential $proxyCred

# Automated: build credential from SecureString
$user = 'CORP\svc_automation'
$pass = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force
$proxyCred = New-Object System.Management.Automation.PSCredential($user, $pass)

Invoke-RestMethod -Uri 'https://api.service.com/data' `
    -Proxy 'http://proxy.corp.example.com:8080' `
    -ProxyCredential $proxyCred

Bypass Proxy for Internal Hosts

Internal URLs should not route through the proxy. In PowerShell 7, use -NoProxy to skip the proxy entirely for a specific call. In PowerShell 5.1, set -Proxy '' or configure [System.Net.WebRequest]::DefaultWebProxy.BypassList for session-wide bypass.

# PowerShell 7: bypass proxy for this call
Invoke-RestMethod -Uri 'http://internalapp.corp.local/api' -NoProxy

# PowerShell 5.1: set session-level bypass list
[System.Net.WebRequest]::DefaultWebProxy.BypassList = @(
    '*.corp.local',
    '10.*',
    '192.168.*'
)

Set Default Proxy in Script

To avoid repeating proxy parameters on every call, set the default proxy once at the top of your script. All subsequent web requests in the session inherit the setting.

# Set default proxy for entire script session
$proxy = New-Object System.Net.WebProxy('http://proxy.corp.example.com:8080', $true)
$proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
[System.Net.WebRequest]::DefaultWebProxy = $proxy

# All subsequent Invoke-WebRequest calls use this proxy automatically
Invoke-WebRequest -Uri 'https://api.external.com/data'
Invoke-RestMethod -Uri 'https://api.external.com/v2/items'

Test Connectivity Through Proxy

Before adding proxy settings to production scripts, verify that your proxy configuration actually reaches the target. A simple StatusCode check confirms connectivity. A successful 200 response means the proxy accepted the request and the remote server responded.

try {
    $response = Invoke-WebRequest -Uri 'https://api.github.com' `
        -Proxy 'http://proxy.corp.example.com:8080' `
        -UseDefaultCredentials `
        -ErrorAction Stop

    Write-Host "Connected. Status: $($response.StatusCode)" -ForegroundColor Green
} catch {
    Write-Warning "Connection failed: $($_.Exception.Message)"
}

Common Errors and Fixes

  • System proxy set but PowerShell ignores it — must use -UseDefaultCredentials. When WinHTTP proxy is configured but requests still fail, add -UseDefaultCredentials to pass your Windows identity to the proxy. Without it, PowerShell sends an anonymous request the proxy rejects.
  • HTTPS inspection proxy requires certificate trust. Corporate proxies that decrypt HTTPS traffic present a self-signed or internal CA certificate. PowerShell rejects it with “Could not establish trust relationship.” Import the proxy’s root CA into the Windows Trusted Root store, or add -SkipCertificateCheck (PowerShell 7 only) for testing.

Related Cmdlets / See Also

Wrapping Up

Proxy issues are the most common reason PowerShell web cmdlets fail in corporate environments. Start with -UseDefaultCredentials for NTLM/Kerberos proxies, add -Proxy and -ProxyCredential when explicit credentials are required, and set a session default at script startup to keep individual call sites clean.

#corporate#invoke-webrequest#network#proxy
Send-Item -To