TLS Inspecting Proxies

Nothing here needs configuring — it explains a fallback the scripts take on their own.

On a network behind a TLS-inspecting proxy (Zscaler and similar), Python may refuse the connection with CERTIFICATE_VERIFY_FAILED. Two things cause it, and both have to be true to break: the proxy’s root CA is absent from certifi, and Python 3.13+ enables VERIFY_X509_STRICT, which rejects that root outright when its Basic Constraints are not marked critical. curl uses the OS trust store and is not strict, so it connects where Python cannot.

The scripts handle this themselves: call() tries urllib first and, only on a verification failure, prints a one-line note and switches to curl for the rest of the session. The key stays out of ps on both paths — the curl path passes the Authorization header through curl --config - on stdin, never in argv. That header is the only thing on stdin: the URL, method, and body all travel as argv elements, so nothing spec-derived can inject a directive into the config that carries the key. Nothing to configure; if is missing too, the error says so.