Error "403: invalid SDK key" when initialising .NET SDK behind proxy or with NTLM authentication – LaunchDarkly

Affected: .NET SDK v6.0+ server-side

Symptoms

The following symptoms occur when initialising the .NET SDK in an environment with proxy authentication:

The SDK logs show HTTP error 403 (invalid SDK key)
The SDK shuts down after failing to connect to stream.launchdarkly.com
Flag evaluations return default values
The same SDK key works from a different environment or machine
The key appears correct and valid in the LaunchDarkly dashboard

Cause

A network proxy, especially one that uses NTLM authentication, may intercept or alter outbound HTTP requests.

When the proxy blocks or modifies the SDK’s request to LaunchDarkly, the SDK interprets the failed response as a 403 error. This results in the misleading message that the SDK key is invalid, even if the key is correct.

Solution

Use one of the following approaches to let the SDK reach LaunchDarkly:

Option 1: Allowlist LaunchDarkly domains

Allow outbound traffic to: stream.launchdarkly.com, app.launchdarkly.com, events.launchdarkly.com.
If your proxy rules require IP addresses, use the IP ranges in LaunchDarkly IP addresses for allowlisting.

Option 2: Bypass the proxy for LaunchDarkly traffic

Exclude LaunchDarkly domains from the proxy by setting the standard NO_PROXY environment variable (or no_proxy on Linux/macOS) to: stream.launchdarkly.com,app.launchdarkly.com,events.launchdarkly.com.

Example: Windows PowerShell
```
setx NO_PROXY "stream.launchdarkly.com,app.launchdarkly.com,events.launchdarkly.com"
```
Restart the application so the updated environment variable takes effect.
Confirm that the SDK initialises successfully and flag evaluations return expected values.

Option 3: Provide credentials to the proxy

Configure the underlying HttpClientHandler with the correct proxy and NTLM credentials. Example:

using System.Net;
using LaunchDarkly.Sdk.Server;

var handler = new HttpClientHandler
{
    Proxy = new WebProxy("http://proxy.example.com:8080")
    {
        Credentials = CredentialCache.DefaultNetworkCredentials   // or new NetworkCredential("user","pass","domain")
    },
    UseProxy = true
};

var config = Configuration.Builder(sdkKey)
    .Http(HttpConfigurationBuilder.DefaultHttpClient
        .WithMessageHandler(() => handler))
    .Build();

var client = new LdClient(config);

Deploy the change and verify that the SDK connects and initialises.

After applying any of these options, watch the application logs. You should see the SDK successfully initialised, and flag evaluations should return the expected values.