Custom proxies

About the Ingrazzio proxy

Ingrazzio is JetBrains' internal proxy protocol that Junie uses to communicate with LLM providers. The production Ingrazzio endpoint is https://ingrazzio-cloud-prod.labs.jb.gg.

When Junie connects through an Ingrazzio proxy, it uses the base URL to access several sub-endpoints:

• LLM chat — the base path handles streaming chat completion requests.

• Web search — the /search path provides web search capabilities.

• URL extraction — the /extract path fetches and extracts content from URLs.

• Authentication — the /auth/test and /auth/reset paths validate the token and license state.

When using the default JetBrains provider, Junie authenticates automatically via JetBrains Account (JBA). When using a custom proxy, JBA authentication is bypassed — you must supply any required credentials (such as Authorization: Bearer <token>) through the proxy's headers field. All the sub-endpoints above, including authentication, are routed through the selected proxy with those headers.

Configure a proxy

Add a proxies array to your config.json. Each entry describes a named proxy endpoint:

Select a proxy as the active provider

To make Junie use a configured proxy, set the provider field to the proxy name:

You can also override the provider at runtime with the --provider CLI flag:

When a proxy is selected as the provider, Junie does not use JetBrains AI authentication. All authentication must be handled through the headers you configure on the proxy entry.

Legacy: the INGRAZZIO_URL environment variable

Setting the INGRAZZIO_URL environment variable creates an implicit Ingrazzio-kind proxy named ingrazzio-env pointing at that URL — no config.json entry is required:

The synthetic proxy behaves like a proxy declared in config.json:

• All requests — LLM chat, web search, URL extraction, and authentication (/auth/test, /auth/reset) — are routed through the given URL, and it appears in the model selector next to configured proxies.

• It automatically becomes the default provider unless another provider is selected via the CLI (--provider) or config.json.

• If config.json declares any Ingrazzio-kind proxy, that configuration takes precedence and INGRAZZIO_URL is ignored entirely.

• If an ingrazzio token is supplied via the environment (for example, JUNIE_API_KEY or EJ_AUTH_INGRAZZIO_TOKEN), it is sent as the Authorization header of the proxy's requests; otherwise Junie falls back to the JetBrains Account token.

Supported proxy kinds

The kind field determines which protocol Junie uses to communicate with the proxy.

Bedrock proxies

A Bedrock proxy routes Anthropic models through an AWS Bedrock-compatible gateway. Requests are sent to <api-url>/model/<wire-name>/invoke, where <wire-name> is the provider-side model id with Bedrock's default cross-region inference prefix.

Because Bedrock model ids differ from Junie's model ids, a Bedrock proxy needs one extra field beyond the common ones:

If the proxy's headers include an Authorization header, it is used as-is; otherwise Junie falls back to the JetBrains Account token.

Quick setup example

1. Create a configuration file (for example, my-config.json):

2. Run Junie with the custom config:

You can still override the model at runtime with the --model flag:

Merging proxies across configuration files

When multiple configuration files define proxies, they are merged by name:

• If two files define a proxy with the same name, the higher-priority file's fields override the lower-priority file's fields on a per-field basis.

• Headers from both files are combined (deduplicated).

• Proxies with different names are all included in the final list.

For the configuration precedence order, see Configuration files.

Limitations

• Only the Ingrazzio and Bedrock proxy kinds are currently supported. Other kinds are reserved for future use.

• Proxy configuration is only available through config.json. There are no dedicated CLI flags for defining proxy entries.

• When using a proxy provider, JetBrains AI authentication is bypassed entirely. You must supply any required credentials via the headers field.