How to Configure GitHub Codespaces Port Forwarding for Copilot Custom Endpoints

A developer running a custom language model proxy inside a containerized workspace will quickly discover that pointing their AI client to the forwarded domain URL results in immediate connection failure. The core of this issue lies not in the routing protocol, but in the default security boundaries of GitHub Codespaces. By default, every port forwarded from a codespace is set to private. This default setting protects your remote development environment from unauthorized access, but it introduces a major barrier when configuring github codespaces port forwarding with github copilot custom endpoints.

Configuring port forwarding for custom Copilot endpoints allows developers inside containerized Codespaces to securely route Copilot requests to mock APIs or enterprise LLM proxies. However, because private forwarded ports require GitHub authentication to accept requests, which requires scoping visibility rules, any external client attempting to connect to the remote domain URL without the appropriate headers will be blocked. When the GitHub Copilot extension running in your editor attempts to ping a custom localhost proxy using the remote domain URL, the request hits the GitHub authentication gateway. Because the Copilot extension does not send the required session cookies or Codespaces tokens, the gateway rejects the connection, returning a 401 Unauthorized status or redirecting the request to a GitHub login page. This breaks the link between the assistant and the proxy.

To connect to a private port at the remote domain, you must authenticate by using the GITHUB_TOKEN access token in your request. This requirement prevents headless extension clients from accessing the proxy directly. This specific problem is not covered in standard development guides. Most documentation assumes you are accessing a web application through a browser, where the browser automatically handles the GitHub OAuth cookies. When you redirect a headless extension like GitHub Copilot to a remote URL, the client lacks a mechanism to authenticate with the gateway. To establish a reliable connection to a custom proxy, developers must understand how to bypass this authentication gate without exposing their local development servers to the public internet.

• How to Run Cline in GitHub CodespacesRunning Cline in GitHub Codespaces lets developers spin up cloud-hosted container environments containing the AI coding...
• How to Configure the Base44 GitHub App IntegrationSetting up the Base44 GitHub App integration enables teams to sync visual configurations to a repository. This guide...
• How to Configure GitHub Codespaces Devcontainer for GitHub CopilotStandardizing your development environment with a devcontainer.json configuration file ensures that team members have...
• How to Configure GitHub Codespaces for GitHub Copilot MCP ServersRunning Model Context Protocol (MCP) servers inside cloud-hosted development environments requires a shift from local...
• How to Configure Repository-Level Custom Instructions for GitHub CopilotFailing to guide AI coding assistants leads to code duplication and technical debt. According to GitClear's 2026...
• How to Configure GitHub Codespaces for GitHub Copilot Agent ModeDeployHQ's GitHub Copilot guide notes that GitHub Copilot is the most widely used AI coding assistant, with over 20...

More on this subject: GitHub Copilot (89 guides)

To establish a stable environment, you must automate the port forwarding process rather than manually adding ports after the workspace launches. The devcontainer.json configuration file allows you to define the container environment, including which ports are exposed and how they behave. Devcontainer.json portAttributes allow automating port settings upon workspace startup, ensuring that the local proxy port is prepared for the AI assistant immediately.

To configure this environment, you must forward port 5000 inside the devcontainer.json file to handle the custom copilot endpoint devcontainer. To configure this automation, create or modify the .devcontainer/devcontainer.json file in your repository root. You must add the port number to the forwardPorts array and define its properties inside the portsAttributes object. In this example, we forward port 5000, which is a common port for local LLM proxies or API mock servers:

{
  "name": "Developer Workspace",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "forwardPorts": [5000],
  "portsAttributes": {
    "5000": {
      "label": "Copilot Custom Proxy",
      "onAutoForward": "ignore",
      "visibility": "private"
    }
  }
}

By declaring these settings in your configuration, GitHub Codespaces forwards port 5000 as soon as the container builds. The onAutoForward property is set to ignore to prevent the IDE from displaying a notification popup or opening a browser tab when the port starts listening. Setting the visibility to private ensures that the port remains secure within the Codespace security boundary, protecting the proxy from external unauthorized requests.

This configuration is committed directly to your version control repository, establishing a consistent template for all developers on your team. However, simply forwarding the port in devcontainer.json does not solve the authentication blocker. We must still configure the GitHub Copilot extension settings to route requests through the local loopback interface.

Configure Fast.io workspaces for your Codespaces configuration

Store configurations, API mocks, and environment variables securely in shared workspaces. Connect coding agents to the Fast.io MCP server. Every organization starts with a 14-day free trial, which requires a credit card. Plans start with Starter at $29/mo.

Start 14-Day Trial

Once the container is configured to forward the port, you must configure the GitHub Copilot extension settings in VS Code. To redirect Copilot requests to the proxy, you must edit your workspace settings. In VS Code, you can configure these options under the github.copilot.advanced configuration block.

Developers looking for ways to set a github copilot overrideUrl in codespaces will find that the extension does not offer a single public URL input. Instead, advanced users must override the underlying API routes inside their client editor settings. To configure these settings, add the custom API URLs to the settings file at .vscode/settings.json inside your repository:

{
  "github.copilot.advanced": {
    "debug.overrideProxyUrl": "http://127.0.0.1:5000",
    "debug.overrideCAPIUrl": "http://127.0.0.1:5000/v1"
  }
}

For example, you can configure your editor settings to use a proxy address such as http://localhost:3128. In the text box under "Proxy," type the address of your proxy server, for example http://localhost:3128. This configuration routes all Copilot API calls to the proxy rather than the default GitHub endpoints. The choice of the endpoint URL is critical. If you were to configure the extension using the remote domain URL of the codespace, the connection would fail because the request lacks the required GitHub session cookies.

By pointing the configuration to http://127.0.0.1:5000, the connection behaves differently depending on how you connect to your codespace:

1. VS Code Desktop: When using the VS Code Desktop application, the client automatically forwards the remote port 5000 to your local computer's loopback address (127.0.0.1:5000) over a secure SSH tunnel. This tunnel is authenticated at the editor level. Because the traffic flows inside the local loopback tunnel, it bypasses the external GitHub authentication gateway completely. The Copilot extension on your local machine communicates with http://127.0.0.1:5000 without requiring any additional session tokens.
2. VS Code Web: If you use the browser-based editor, the browser does not support local loopback port forwarding to your physical machine. The browser client must connect to the forwarded port using the remote domain URL. Because the port is private, the browser blocks these API requests due to CORS policies, and the network client cannot pass the auth gateway. To resolve this in the browser, developers must change the port visibility to public using the Ports panel or the CLI. However, changing the visibility to public exposes your LLM proxy to the open internet, which is a significant security vulnerability in enterprise environments.

To successfully forward local proxy in codespaces for copilot, you must configure both the container port exposure and the loopback forwarding tunnel. For secure workflows, teams should mandate the use of VS Code Desktop when using custom endpoints, allowing them to keep port visibility set to private while routing Copilot requests through the local loopback interface.

Managing devcontainer configurations, proxy schemas, and custom API definitions across a team of developers and automated agents requires a secure, shared storage system. When teams rely on local filesystems, configurations are easily lost when containers are deleted. Standard cloud storage solutions like Google Drive or Dropbox are also poorly suited for developer workflows. They lack built-in semantic search, do not support real-time collaboration for automated agents, and frequently cause file version conflicts when multiple developers or agents commit updates simultaneously.

To resolve these storage and coordination problems, teams can use Fast.io to create shared /product/workspaces/. Fast.io provides org-owned workspaces with granular permissions, allowing teams to store setup templates, API reference documents, and configuration files securely. Every file in a Fast.io workspace retains a complete version history, and all actions are recorded in an append-only audit log. This ensures that changes made by team members or autonomous agents are fully auditable, preventing file overwrites and tracking context changes.

Fast.io provides persistent storage designed for both developers and AI agents, which you can read about in the /storage-for-agents/ guide. You can connect coding agents directly to the Fast.io Model Context Protocol (MCP) server, which runs at https://mcp.fast.io/mcp or https://mcp.fast.io/mcp/key with a bearer token. For agent onboarding and prompt styling, you can reference the guidelines at fast.io/llms.txt. The workspace automatically indexes files for semantic retrieval via Intelligence Mode, allowing both developers and agents to run RAG queries directly against your documentation. You can also use Metadata Views to define typed schemas (such as Text, Boolean, or JSON) to extract structured fields from configuration logs and proxy outputs without writing custom scripts.

Every organization starts with a 14-day free trial, which requires a credit card | Plans are Starter at $29/mo, Business at $99/mo, and Growth at $299/mo. For more details on plans and pricing, visit the /pricing/ page. Teams can choose from 3 subscription tiers: Starter, Business, or Growth, to fit their development scale. For example, if you run a coding agent like Claude Code or Cursor inside your codespace, you can declare the connection to the Fast.io MCP server in your configuration:

{
  "mcpServers": {
    "fastio": {
      "url": "https://mcp.fast.io/mcp"
    }
  }
}

This integration enables the agent to pull references, verify mock endpoints, and store execution reports in your shared workspace, keeping your environment synchronized and secure.

After applying the configuration, you should verify the connection and troubleshoot any network errors. To test the port forwarding setup, open a terminal inside your codespace and verify that the custom proxy is running and listening on port 5000. You can list the active forwarded ports using the GitHub CLI:

gh codespace ports

This command displays a list of forwarded ports, their local addresses, and their visibility status. To inspect the connection between the GitHub Copilot extension and your proxy, you can view the extension log output in VS Code. Open the Output panel and select "GitHub Copilot" from the dropdown menu. If the connection is successful, you will see HTTP requests being routed to http://127.0.0.1:5000.

If you experience connection errors, check the following common troubleshooting steps:

1. Verify Local Port Binding: Ensure that your proxy server inside the container binds to the address 0.0.0.0 or 127.0.0.1. If the proxy binds only to localhost inside the container's network namespace, Codespaces may fail to route external traffic to it.
2. Address SSL Handshake Failures: Custom proxies often use self-signed certificates, which can cause VS Code to reject the connection due to SSL errors. You can disable strict SSL checks in VS Code by adding "http.proxyStrictSSL": false to your settings.json file. Alternatively, you can point the Node.js runtime to your custom root certificate file using the NODE_EXTRA_CA_CERTS environment variable inside your container.
3. Resolve 302 Redirect Loops: If you see log entries indicating that requests are being redirected to github.com/login, your configuration is likely using the remote domain URL for a private port instead of the local loopback address 127.0.0.1:5000. Switch the settings to use the local loopback address.
4. Inspect Container Creation Logs: If the port is not forwarded automatically on startup, check the container build log in the terminal. Ensure that the devcontainer.json file has valid JSON formatting and does not contain syntax errors or trailing commas.

By systematically verifying these settings, developers can maintain a secure and reliable connection to their custom LLM endpoints, keeping their AI-assisted workflows active within containerized Codespaces.