External proxy

An external proxy lets you chain the proxy's egress through another upstream proxy — so the request reaches its destination from somewhere else, while you still capture it locally.

What it does

Normally the proxy dials each destination directly. When you configure an external proxy, every outbound leg goes through that upstream instead: the proxy still terminates and decrypts traffic for you (so you see everything), but the final hop to the internet rides the upstream you named.

Use it to route captured traffic through a corporate proxy, a regional egress, or another tool in your chain — while still getting full request/response capture in your dashboard.

Configure it

Set the external proxy in your dashboard settings. It has the shape:

{
  "enabled": true,
  "host": "upstream.example.com",
  "port": 8080,
  "username": "optional-user",
  "password": "optional-pass"
}

It's only applied when it's usable — that means enabled is true, host is non-empty, and port is a valid positive number. If any of those is missing, the proxy ignores the config and dials directly, so a half-filled form never silently breaks egress. username / password are optional; when set, the proxy authenticates to the upstream with them.

What it covers

Once usable, the external proxy applies to every outbound path:

• Plain HTTP forwards — sent to the upstream in absolute-URI form for it to forward.
• Decrypted (MITM) traffic — the proxy's dial to the real server goes through the upstream.
• Raw HTTPS passthrough — the CONNECT tunnel is established via the upstream.

So no matter whether a host is being decrypted or passed through, its egress takes the same route.

Per-device or global

Like the other settings, the external proxy can be global or overridden per device. A device can set its own external proxy, or explicitly set it to none to opt out of upstream egress for itself while the global value stays in place for everyone else. The proxy uses each device's effective value, and falls back to the global setting for traffic it can't attribute to a specific device.

Note: This mirrors the iOS app's external-proxy setting, so chaining behaves the same across capture clients.

Next

• What gets decrypted — control which hosts are MITM'd before they egress.
• Per-device attribution — how per-device settings are resolved.