Watson Node SDK Proxy Settings for API and IAM Requests

When a Watson call fails before reaching the service, check whether the failed request is the IAM token request. An IAM-authenticated call can contact IAM first and the service second.

In an application already using the relevant Watson SDK and tunnel dependency, give the same network settings to both objects:

const tunnel = require('tunnel');
const AssistantV2 = require('ibm-watson/assistant/v2');
const { IamAuthenticator } = require('ibm-watson/auth');

const httpsAgent = tunnel.httpsOverHttp({
  proxy: { host: 'proxy.example', port: 8080 },
});

const network = { httpsAgent, proxy: false };
const authenticator = new IamAuthenticator({
  apikey: apiKey,
  ...network,
});
const assistant = new AssistantV2({
  version: serviceVersion,
  serviceUrl,
  authenticator,
  ...network,
});

Keep the application's existing apiKey, serviceVersion and serviceUrl. The API and IAM endpoint remain their intended destinations; the proxy listener belongs in the agent. The HTTP proxy list can provide candidate addresses when both public service endpoints may be reached through a proxy you choose.

tunnel.httpsOverHttp establishes the HTTPS path through the HTTP proxy. proxy: false prevents the SDK from applying another built-in proxy configuration on top of that custom agent.

If you previously supplied these settings only to assistant, the authenticator is the missing place to check. Basic authentication and an already-issued bearer token have different token-acquisition lifecycles, so this extra IAM path applies to the network-based authenticator used here.