Configure the proxy

ProxyPro listens on 127.0.0.1:9090. Clients reach it three ways: the in-app system-proxy toggle, the macOS Network preferences, or process-level flags (Chrome, curl, etc.).

Recommended — in-app toggle

Click ○ system proxy OFF in the app header. It flips to ● system proxy ON:

• Calls networksetup -setwebproxy + -setsecurewebproxy for every enabled network service (Wi-Fi, Ethernet, USB ethernet).
• Auto-disables when:
  • You quit the app (cmd+Q)
  • The engine subprocess crashes
  • The process receives SIGINT / SIGTERM

Tip

The auto-disable is what saves you when the app crashes mid-session. Without it, your browser would silently lose internet because the system proxy still pointed at a dead :9090.

Manual — system preferences

# Enable
networksetup -setwebproxy "Wi-Fi" 127.0.0.1 9090
networksetup -setsecurewebproxy "Wi-Fi" 127.0.0.1 9090

# Check
networksetup -getwebproxy "Wi-Fi"

# Disable
networksetup -setwebproxystate "Wi-Fi" off
networksetup -setsecurewebproxystate "Wi-Fi" off

Swap "Wi-Fi" for your active service. List them with:

networksetup -listallnetworkservices

Per-process — Chrome

Don’t want to touch the system proxy? Launch a separate Chrome process just for ProxyPro:

open -na "Google Chrome" --args --proxy-server="http://127.0.0.1:9090"

Your normal Chrome keeps working as usual.

Per-process — curl

curl --proxy http://127.0.0.1:9090 https://example.com

Set the https_proxy env var to make it stick for a shell session:

export https_proxy=http://127.0.0.1:9090
export http_proxy=http://127.0.0.1:9090

Per-process — Node, Python, others

Node

NODE_EXTRA_CA_CERTS=~/Library/Application\ Support/ProxyPro/ca/root.pem \
  https_proxy=http://127.0.0.1:9090 \
  node my-script.js

NODE_EXTRA_CA_CERTS adds the ProxyPro CA to Node’s trust store for the duration of the process.

Python (requests)

import requests
r = requests.get(
    'https://example.com',
    proxies={'https': 'http://127.0.0.1:9090', 'http': 'http://127.0.0.1:9090'},
    verify='/Users/you/Library/Application Support/ProxyPro/ca/root.pem',
)

Go

import (
    "crypto/x509"
    "net/http"
    "net/url"
    "os"
)

caPem, _ := os.ReadFile("/Users/you/Library/Application Support/ProxyPro/ca/root.pem")
roots := x509.NewCertPool()
roots.AppendCertsFromPEM(caPem)

tr := &http.Transport{
    Proxy: http.ProxyURL(&url.URL{Scheme: "http", Host: "127.0.0.1:9090"}),
    TLSClientConfig: &tls.Config{RootCAs: roots},
}
client := &http.Client{Transport: tr}

SSL Proxying (HTTPS decryption)

ProxyPro now tunnels HTTPS by default — CONNECT requests pass through as raw TCP unless you explicitly allow the host. This means:

• Postman, Node.js, Java, Go — just work out of the box, no CA trust required.
• You want to inspect a host? Add it to the SSL Proxying allowlist in the app.
• Existing rules automatically decrypt — if you have a Map Local or Map Remote rule on a host, that host is decrypted + captured automatically.
• Legacy mode available — toggle Decrypt: All to restore the old behavior (decrypt everything, like v0.1.0-alpha did). Use this as a rollback if needed.

The CA-trust requirement still exists

Decrypting a host requires the client to trust the ProxyPro root CA. Tunnel-by-default just stops breaking clients that don’t have the CA installed. If you add a host to the allowlist but your client rejects the CA during TLS handshake, the engine auto-detects the failure and tunnels the connection instead, emitting a CA-trust warning in the UI.

Once you install the ProxyPro CA (see Install the certificate), that host will decrypt and appear in captures.

Add a host to the allowlist

1. Open the SSL Proxying panel in the app.
2. Enter the host: exact match (api.example.com) or wildcard subdomain (*.example.com — matches a.example.com, a.b.example.com, but NOT example.com).
3. Click Add.
4. The next request to that host will be decrypted + captured (assuming the client trusts the CA).

Decrypt: All (legacy mode)

If you want to decrypt every HTTPS host (old behavior):

1. Open the SSL Proxying panel.
2. Toggle Decrypt: All.
3. All HTTPS hosts are now decrypted unless they’re explicitly blocked (rarely).

To go back to allowlist mode, toggle Decrypt: All off again.

Note

Config changes apply to new connections only. If you have an open stream to a host and add/remove it from the allowlist, existing streams continue as-is.

What ProxyPro does to your traffic

• HTTP/1.1 — full decrypt + capture.
• HTTP/2 — ALPN-negotiated h2, full decrypt + capture.
• HTTP/3 (QUIC) — ALPN-stripped via Alt-Svc header rewrite. Browsers fall back to h2. We do not decrypt QUIC directly.
• WebSocket — handshake captured, frames relayed with byte + frame counters (per-message reassembly + deflate coming in P03.5).
• gRPC — content-type sniffed, heuristic protobuf walker decodes messages (named-field decoding via reflection in P04.5).
• Pinned apps (banking, Spotify, most native iOS apps) will refuse to trust our CA and fail to connect through the proxy. That’s expected.
• HTTPS tunneling — by default, unallowlisted HTTPS is tunneled (raw TCP relay) and not decrypted, so your requests go through without a CA-trust requirement. See SSL Proxying above.