Claude apps gateway configuration

​

File structure

• listen: bind address, public URL, TLS termination
• oidc: your identity provider (IdP), including issuer, client, claim mapping, and who may sign in
• session: the bearer tokens the gateway mints, with secret and lifetime
• store: PostgreSQL, for device grants and rate-limit counters
• upstreams: where inference goes, whether Anthropic, Amazon Bedrock, Claude Platform on AWS, Google Cloud’s Agent Platform, or Microsoft Foundry

• admin: Admin API auth and retention for spend limits
• enforcement: spend-limit fail-open or fail-closed behavior
• pricing: contracted rates and a multiplier for the spend meter and for the cost figures developers see
• models and auto_include_builtin_models: admin-curated model list and per-upstream IDs
• managed: managed settings policies by IdP group
• telemetry: OTLP forwarding to your observability stack
• access_control, limits, timeouts, rate_limits: IP allow/deny, request size caps, upstream time-to-first-byte, and per-IP sign-in limits
• load_test_mode: load testing the gateway without calling a model provider

​

Secret expansion

​

Required sections

​

listen

​

oidc

​

IdP requests through a forward proxy

​

Proxy-only egress

export HTTPS_PROXY=http://proxy.corp.example.com:3128
export NO_PROXY=
export no_proxy=
export CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY=1

• HTTPS_PROXY or HTTP_PROXY is set.
• NO_PROXY and no_proxy are empty. If your platform injects either into pods, set both to an empty value on the gateway container. Listing a telemetry collector in NO_PROXY keeps proxy-only egress off.
• CLAUDE_GATEWAY_ALLOW_LOOPBACK isn’t turned on. A collector or IdP on the pod’s own loopback can’t be combined with proxy-only egress, because a loopback address handed to the proxy would be the proxy host’s own, so give those services an address the proxy can reach instead. For the same reason the gateway refuses localhost-style names outright while proxy-only egress is active.

​

session

​

store

​

upstreams

​

Upstream error messages

• An upstream returned a status the gateway doesn’t fail over on: that upstream’s response. The gateway tries no further upstreams.
• Every upstream the gateway tried failed in a way it fails over on: the last 429. When none returned a 429, the gateway prefers, in order, the last 401 or 403, the last 404, and the last 501. When none returned any of those, the gateway’s own 502, all upstreams failed (N attempted), where N counts every entry in upstreams, including entries the gateway skipped because they don’t serve the requested model.

• 400 or 413 in Anthropic’s standard error envelope: the upstream’s own message, such as prompt is too long. Claude Platform on AWS, Agent Platform, and Microsoft Foundry return this envelope for model API rejections.
• 400 or 413 in the provider’s own shape: a capability_rejected: token. When the gateway can’t classify the rejection, upstream rejected the request on a 400 or request too large for this upstream on a 413.
• Any other status: generic per-status copy, such as upstream rate limit exceeded on a 429.

​

Anthropic API

upstreams:
  - provider: anthropic
    auth:
      api_key: ${ANTHROPIC_API_KEY}
    # OR an OAuth bearer (e.g. a Workload-Identity-Federation-exchanged token):
    #   oauth_token: ${file:/var/run/secrets/anthropic-oauth-token}
    # base_url: https://api.anthropic.com   # default; override for a forward proxy

• api_key: sends x-api-key. Rotate it in the Claude Console and update the env var.
• oauth_token: sends Authorization: Bearer. Use the bearer form when your org issues short-lived tokens instead of long-lived API keys. The bearer is read once at startup, so refresh by remounting the secret and restarting.

upstreams:
  - provider: anthropic
    auth:
      federation_rule_id: ${ANTHROPIC_FEDERATION_RULE_ID}
      organization_id: ${ANTHROPIC_ORGANIZATION_ID}
      identity_token_file: /var/run/secrets/anthropic/id-token
      # workspace_id: wrkspc_...       # required if the rule covers >1 workspace
      # service_account_id: svac_...   # optional expected-target check

Per-user identity headers for a proxy you run

upstreams:
  - provider: anthropic
    base_url: https://upstream-gateway.internal.example.com
    auth:
      api_key: ${PROXY_KEY}
    forward_user_identity: true        # default false

​

Amazon Bedrock

upstreams:
  - provider: bedrock
    region: us-east-1
    auth: {}                           # preferred: AWS default credential chain
    # OR explicit credentials:
    # auth:
    #   aws_access_key_id: ${AWS_AKID}
    #   aws_secret_access_key: ${AWS_SK}
    #   aws_session_token: ${AWS_ST}
    # OR a Bedrock API bearer token:
    # auth:
    #   aws_bearer_token: ${AWS_BEARER_TOKEN}
    # Override the bedrock-runtime endpoint for FIPS or VPC-endpoint deployments:
    # base_url: https://bedrock-runtime-fips.us-east-1.amazonaws.com

​

Claude Platform on AWS

upstreams:
  - provider: anthropicAws
    region: us-east-1
    workspace_id: wrkspc_...
    auth:
      api_key: ${ANTHROPIC_AWS_API_KEY}   # sent as x-api-key
    # OR SigV4 via the AWS default credential chain:
    # auth: {}
    # OR explicit SigV4 credentials:
    # auth:
    #   aws_access_key_id: ${AWS_ACCESS_KEY_ID}
    #   aws_secret_access_key: ${AWS_SECRET_ACCESS_KEY}
    # Override the derived endpoint:
    # base_url: https://aws-external-anthropic.us-east-1.api.aws

​

Google Cloud Agent Platform

upstreams:
  - provider: vertex
    region: us-east5
    project_id: example-prod
    auth: {}                           # preferred: Application Default Credentials
    # OR a service account key file:
    # auth: { service_account_json: /secrets/sa.json }
    # Override the aiplatform endpoint for Private Service Connect:
    # base_url: https://us-east5-aiplatform.p.googleapis.com

​

Microsoft Foundry

upstreams:
  - provider: foundry
    resource: example-foundry              # https://example-foundry.services.ai.azure.com
    auth: { use_azure_ad: true }        # preferred: DefaultAzureCredential / Managed Identity
    # OR an API key:
    # auth:
    #   api_key: ${FOUNDRY_API_KEY}

​

Static headers on upstream requests

upstreams:
  - provider: vertex
    region: us-east5
    project_id: example-prod
    base_url: https://upstream-proxy.internal.example.com
    auth: {}
    headers:
      x-source: claude-apps-gateway
      x-proxy-token: ${PROXY_TOKEN}

• authorization and x-api-key
• host, content-type, and user-agent
• Any name starting with anthropic-, x-goog-, x-amz-, or x-amzn-

​

Multiple upstreams

upstreams:
  # Primary: provisioned throughput in your home region.
  - name: bedrock-pt
    provider: bedrock
    region: us-east-1
    auth: {}
  # Overflow: on-demand cross-region.
  - name: bedrock-od
    provider: bedrock
    region: us-west-2
    auth: {}
  # Different account: a separate Bedrock allotment via assumed-role creds.
  - name: bedrock-acct2
    provider: bedrock
    region: us-east-1
    auth:
      aws_access_key_id: ${ACCT2_AKID}
      aws_secret_access_key: ${ACCT2_SK}
  # Last resort: direct Anthropic API.
  - name: anthropic-fallback
    provider: anthropic
    auth:
      api_key: ${ANTHROPIC_API_KEY}

# Per-upstream model IDs are keyed on the upstream's `name:`.
models:
  - id: claude-opus-4-8
    label: Claude Opus 4.8
    upstream_model:
      bedrock-pt: arn:aws:bedrock:us-east-1:111111111111:provisioned-model/abcdef
      bedrock-od: us.anthropic.claude-opus-4-8
      bedrock-acct2: us.anthropic.claude-opus-4-8
      anthropic-fallback: claude-opus-4-8

​

Optional sections

​

admin

admin:
  # Named static API keys for the admin endpoints, sent as x-api-key.
  # The id appears in the audit log as admin-key:<id> so each key is
  # attributable. Array for rotation: add the new key, roll clients,
  # remove the old.
  write_keys:
    - { id: terraform, key: "${GATEWAY_ADMIN_WRITE_KEY_TF}" }
    - { id: ci,        key: "${GATEWAY_ADMIN_WRITE_KEY_CI}" }
  read_keys:
    - { id: reporting, key: "${GATEWAY_ADMIN_READ_KEY}" }
  # IdP groups granted full admin via the normal gateway JWT (no API key).
  admin_groups: [platform-finops]
  blocked_message: request an increase at https://go.example.com/claude-limits

​

enforcement

​

pricing

• Claude Code v2.1.227 or later on the gateway server. Earlier versions reject the unknown key at boot.
• An admin: block or, in v2.1.268 or later, a managed: block with at least one policy. The gateway refuses to start with pricing set and neither block, because nothing would read it.

pricing:
  multiplier: 0.85
  overrides:
    - upstream: bedrock-eu
      model: claude-sonnet-4-6
      input: 3.30
      output: 16.50
      cache_read: 0.33
      cache_write: 4.125

• A row replaces list price for requests that upstream, an upstreams[].name, serves for model. That includes the higher fast mode rate, so fast and standard requests meter at the same four rates.
• A built-in ID such as claude-sonnet-4-6, matched like models[].id, covers every dated form, regional Amazon Bedrock form, or Google Cloud’s Agent Platform form the meter prices as that model. Any other string, such as an alias or an inference-profile ARN, matches the ID the client sent or the string sent upstream, case-insensitively.
• Where rows overlap, the meter picks the most specific row rather than the first row: a row whose model is the exact model string sent upstream, then a row matching the exact ID the client sent, then a row naming the built-in model.
• An unknown upstream name fails boot, and so do two rows for one upstream that name the same model, including two spellings of one built-in model. The gateway warns at boot about a row no requestable model can use.
• Web-search requests stay at the $0.01 list price; the multiplier still applies to them.

​

Mark prices up

pricing:
  multiplier: 1.2

​

Send the rates to signed-in clients

• What the gateway adds: unless a policy’s cli block already sets modelPricing, the gateway adds the multiplier and, for every model ID a client can request, the override row of the first upstream that serves that ID. A rate that only a failover upstream charges stays on the gateway.
• Opt one policy out: set modelPricing to {} in that policy’s cli block, and its developers stay at list price.
• Keep a policy’s own rates: a policy whose cli block sets modelPricing with its own multiplier or overrides keeps that modelPricing whole, and the gateway adds no rates of its own to it.

​

models

auto_include_builtin_models: true   # false: expose only the list below
models:
  - id: claude-opus-4-8
    label: Claude Opus 4.8
    # description: optional text shown in clients that surface it
    upstream_model:
      anthropic: claude-opus-4-8
      bedrock: us.anthropic.claude-opus-4-8   # or an inference-profile ARN
      foundry: your-opus-deployment-name

​

managed

managed:
  policies:
    # Specific groups first.
    - match: { groups: [eng-contractors] }
      cli:
        availableModels: [claude-sonnet-4-6]
        permissions: { deny: ["WebFetch", "WebSearch"] }
    # Default catch-all last: matches everyone who authenticated.
    - match: {}
      cli:
        availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]

• Allow-lists: availableModels and permissions.allow. A specific policy’s list fully replaces the base’s.
• Deny-lists and hook arrays: permissions.deny, permissions.ask, disabledMcpjsonServers, deniedMcpServers, blockedMarketplaces, and every hooks event-type array. These take the union of base and policy, so an org-wide deny or audit hook can’t be accidentally dropped by a per-role override.
• Record-typed keys: env, modelOverrides, and skillOverrides. These shallow-merge, so a per-role env block overrides keys it sets and inherits the rest from the base.

• When the value is missing or empty, the gateway rejects the request with the message model is required. That check requires a gateway running Claude Code v2.1.228 or later.
• When the value is present but isn’t a string, the gateway rejects the request with the message model must be a string. Requires a gateway running Claude Code v2.1.221 or later.

​

Matcher values that stop the gateway at boot

• An empty groups list
• An empty entry in groups or in admin_groups
• An empty email_domain
• An email_domain that contains @, whitespace, or a comma. The gateway trims the value and strips one leading @ before this check. Write one bare domain, such as example.com.

• An empty email_domain: the gateway skipped the domain check, so a policy with an empty email_domain and no groups list matched every authenticated user
• An empty groups list: the policy matched no one
• An email_domain containing @, whitespace, or a comma: the policy matched no one
• An empty entry in groups or in admin_groups: the entry matched a user only when that user’s IdP groups claim also contained an empty entry. In admin_groups, that match granted admin access. If your admin_groups list never contained an empty entry, no one gained admin access this way.

​

What goes in cli

managed:
  policies:
    - match: {}
      cli:
        # Model access (also enforced server-side at /v1/messages)
        availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]

        # Permission policy
        permissions:
          deny:
            - "WebFetch"
            - "Read(./.env)"
            - "Read(./secrets/**)"
          disableBypassPermissionsMode: disable   # blocks --dangerously-skip-permissions
        allowManagedPermissionRulesOnly: true     # ignore user/project permission rules

        # Environment pushed into the CLI process. DISABLE_UPDATES blocks
        # background and manual updates; DISABLE_AUTOUPDATER stops only
        # background updates.
        env:
          DISABLE_UPDATES: "1"                    # pin versions via your own distribution

        # Org-wide hooks. Hook commands run on developer machines, not the
        # gateway, so the path must exist on every client OS in the policy.
        hooks:
          PostToolUse:
            - matcher: "Edit|Write"
              hooks:
                - { type: command, command: /usr/local/bin/audit-edit.sh }

• hooks
• env variables that require the developer’s approval, such as proxy and base-URL variables
• shell-execution settings such as apiKeyHelper and statusLine
• the sandbox binary settings sandbox.bwrapPath, sandbox.socatPath, and sandbox.ripgrep
• Sandbox settings that intercept traffic, inject credentials, or weaken isolation, such as sandbox.network.tlsTerminate and the proxy port settings. Security approval dialogs lists them all.

​

MCP servers in a policy

​

Claude Desktop overlay

• The model list, from availableModels
• Disabled tools, from bare tool-name permissions.deny entries. If you set disabledBuiltinTools in the policy’s desktop block, the gateway serves the union of your value and the derived list, so you can disable more tools this way but can’t re-enable one you disabled through permissions.deny
• The egress allowlist, from sandbox.network.allowedDomains. If you set coworkEgressAllowedHosts in the policy’s desktop block, the gateway uses that value instead of the derived list
• An OTLP endpoint that points at the gateway itself, and the signed-in user’s identity attributes. The gateway relays the exports it receives at that endpoint to your forward_to destinations. It includes the endpoint and the attributes when you set both telemetry.forward_to and listen.public_url. Claude Desktop exports every signal with one encoding: http/protobuf, or http/json when you set OTEL_EXPORTER_OTLP_PROTOCOL or one of its per-signal variants to http/json in the policy’s env. Before Claude Code v2.1.261 on the gateway server, the response set http/json regardless, so a collector that accepts only protobuf rejected Claude Desktop’s exports

managed:
  policies:
    - match: { groups: [eng-contractors] }
      cli:
        availableModels: [claude-sonnet-4-6]
      desktop:
        isLocalDevMcpEnabled: false
        disableAutoUpdates: true
        banner: { text: "Contractor build: internal use only" }

• An unknown key
• A recognized key whose value Claude Desktop would reject or silently drop, such as an empty value or a misspelled sub-key inside a nested entry. Before v2.1.260, the gateway silently dropped a misspelled field inside a nested object of a managedMcpServers or orgPluginSettings entry instead of failing at boot.
• A key the gateway computes itself: the inference connection, the model list, and the OTLP relay. Configure those through upstreams, models, and the telemetry section’s forward_to.
• A legacy alias of a current key. In the boot error, the gateway names the canonical key to write.

• disabledBuiltinTools: the gateway uses the union of the base’s list and the policy’s list
• builtinToolPolicy: if you set a tool to a value other than allow in the base, the gateway keeps that value even if you set allow for the same tool in a role policy

​

Precedence with other managed sources

​

telemetry

telemetry:
  forward_to:
    - url: https://otel-collector.internal.example.com
      headers:
        Authorization: ${OTLP_TOKEN}
      # Per-signal opt-in. Default: metrics only.
      metrics: true
      logs: false
      traces: false
    - url: https://api.datadoghq.com/api/v2/otlp
      headers:
        DD-API-KEY: ${DD_API_KEY}

• http://localhost:<port> passes config validation, but the SSRF guard blocks every export with ECONNREFUSED_SSRF unless you set CLAUDE_GATEWAY_ALLOW_LOOPBACK=1 in the gateway’s environment
• http://127.0.0.1:<port> or http://[::1]:<port> fails boot unless that variable is set

• CLAUDE_CODE_ENABLE_TELEMETRY=1
• OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, and OTEL_TRACES_EXPORTER, each set to otlp if at least one forward_to destination enables that signal and to none otherwise
• OTEL_EXPORTER_OTLP_ENDPOINT=<public_url>
• OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf

• Locally set variables: Claude Code applies the pushed variables at the managed tier, so each one overrides the value a developer sets for it locally.
• Locally configured endpoints: with OTLP/HTTP export enabled, the CLI ignores any locally configured endpoint, whether or not the gateway pushed the telemetry variables. Its exports go to the gateway unless a policy names your collector as the endpoint.

​

Add your own labels

telemetry:
  forward_to:
    - url: https://otel-collector.internal.example.com
  resource_attributes:
    service.namespace: claude
    deployment.environment.name: prod

• Names use only letters, digits, ., _, and -
• Names aren’t reserved. Compared in any letter case, the reserved names are everything that starts with user., enduser., or identity., plus service.name, service.version, claude.deployment_mode, host.arch, os.type, os.version, and wsl.version
• Values are non-empty printable ASCII with no space and none of , ; = \ " %
• Values are at most 255 characters as the gateway counts them after percent-encoding, so /, :, and @ each count as three
• Values are text, so quote a number, true, or false

​

Export directly to your collector

• The endpoint comes from the gateway itself. If you set the same variable in an MDM profile or a local managed-settings.json, exports stay on the relay.
• The URL uses https://, or http:// to a loopback address
• The URL resolves to a path ending in /v1/<signal>, with no query or fragment. Claude Code builds that path itself from the generic variable. It uses a per-signal variable such as OTEL_EXPORTER_OTLP_METRICS_ENDPOINT as written, so include the full path there.
• The URL isn’t the gateway’s own host. An endpoint addressed to the gateway keeps the relay path and its session token.
• Neither you nor the developer has configured otelHeadersHelper in any settings source. With a helper configured, every signal stays on the relay.

• If the gateway already pushes the telemetry variables, they cover enablement, selectors, and protocol, and your explicit endpoint overrides the pushed <public_url> value. Set an OTEL_*_EXPORTER selector to otlp yourself only for a signal that no forward_to destination enables.
• If it doesn’t, also set CLAUDE_CODE_ENABLE_TELEMETRY=1, the OTEL_*_EXPORTER selectors, and OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf.

​

When a destination fails

​

HTTP tuning

• At boot: a warning in the operational log recommends allowing only the private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 127.0.0.0/8, ::1/128, and fc00::/7, plus any other internal ranges your developers connect from. If you bind the gateway to a loopback address and set neither trusted_proxies nor public_url, as in local development, the warning doesn’t appear.
• At runtime: the first time a request arrives from an address outside those private ranges, the gateway logs a warning and emits an access.public_client audit event carrying the client IP. Both fire once per process. Link-local addresses, 169.254.0.0/16 and fe80::/10, don’t count as public. The gateway answers /healthz and /readyz before this check runs, so health probes from public ranges don’t trigger it.

​

load_test_mode

load_test_mode:
  enabled: true
  reply_tokens: 750     # roughly how many tokens of text each canned reply carries
  reply_seconds: 9.5    # how long a streamed reply takes

​

Complete example

# Run with:
#   claude gateway --config gateway.yaml
#
# Operational log verbosity is controlled by the CLAUDE_GATEWAY_LOG_LEVEL
# environment variable (debug | info | warn | error; default info). debug
# also logs the claim names in each id_token, for groups_claim diagnosis.
# It does not affect audit events, which are always emitted.

listen:
  host: 0.0.0.0
  port: 8080
  public_url: https://claude-gateway.internal.example.com
  # Omit the tls block when running behind a TLS-terminating ingress.
  # tls:
  #   cert: /certs/gateway.crt
  #   key: /certs/gateway.key
  # trusted_proxies:
  #   - 10.0.0.0/8

oidc:
  issuer: https://example.okta.com
  client_id: 0oa1example2
  client_secret: ${OIDC_CLIENT_SECRET}
  allowed_email_domains:
    - example.com
  # Required when the issuer is the Okta org server, whose id_tokens
  # can omit email and groups; the gateway fills them from /userinfo.
  userinfo_fallback: true
  # allowed_groups: [claude-code-users]
  # Okta emits groups only when the `groups` scope is requested and the
  # app's groups claim filter allows them. The contractors policy below
  # matches on groups, so the scope is requested here.
  scopes: [openid, profile, email, offline_access, groups]
  # extra_auth_params: { access_type: offline, prompt: consent }  # Google
  # groups_claim: groups          # Entra app roles: use `roles`
  # email_claim: email

session:
  jwt_secret: ${GATEWAY_JWT_SECRET}   # openssl rand -base64 32
  # ttl_hours: 1

store:
  postgres_url: ${GATEWAY_POSTGRES_URL}
  # max_connections: 5
  # connect_timeout_seconds: 5
  # readiness_grace_seconds: 300   # keep passing the readiness check through a database failover

# Enables /v1/organizations/spend_limits (mirrors the Anthropic Admin API)
# and per-developer spend enforcement on /v1/messages. Omit to disable.
# Caps themselves are set via the admin API, not here.
# admin:
#   write_keys:
#     - { id: terraform, key: "${GATEWAY_ADMIN_WRITE_KEY_TF}" }
#   read_keys:
#     - { id: reporting, key: "${GATEWAY_ADMIN_READ_KEY}" }
#   admin_groups: [platform-finops]
#   blocked_message: request an increase at https://go.example.com/claude-limits
#   # audit_retention_days: 365
#   # spend_retention_months: 13
#   # identity_retention_days: 90
#   # group_limit_mode: min

# enforcement:
#   fail_closed_on_error: false

# Load test this deployment without calling a model provider. Never on a
# gateway that developers use: every request gets a canned reply.
# load_test_mode:
#   enabled: true
#   # reply_tokens: 750
#   # reply_seconds: 9.5

# Meter at contracted rates instead of USD list price. Requires admin: or a
# managed: policy. With managed:, the same rates also go to signed-in clients.
# Rates below are placeholders, not real contract prices.
# pricing:
#   multiplier: 0.85
#   overrides:
#     - { upstream: anthropic, model: claude-sonnet-4-6, input: 3.30, output: 16.50, cache_read: 0.33, cache_write: 4.125 }

upstreams:
  - provider: anthropic
    auth:
      api_key: ${ANTHROPIC_API_KEY}

  # - provider: bedrock
  #   region: us-east-1
  #   auth: {}

  # - provider: anthropicAws
  #   region: us-east-1
  #   workspace_id: wrkspc_...
  #   auth:
  #     api_key: ${ANTHROPIC_AWS_API_KEY}

  # - provider: vertex
  #   region: us-east5
  #   project_id: example-prod
  #   auth: {}

  # - provider: foundry
  #   resource: example-foundry
  #   auth: { use_azure_ad: true }

auto_include_builtin_models: true
models:
  - id: claude-opus-4-8
    label: Claude Opus 4.8
    upstream_model:
      anthropic: claude-opus-4-8
      # bedrock: us.anthropic.claude-opus-4-8
      # anthropicAws: claude-opus-4-8
      # vertex: claude-opus-4-8
      # foundry: <your-opus-deployment-name>
  - id: claude-sonnet-4-6
    label: Claude Sonnet 4.6
    upstream_model:
      anthropic: claude-sonnet-4-6
  - id: claude-haiku-4-5
    label: Claude Haiku 4.5
    upstream_model:
      anthropic: claude-haiku-4-5

managed:
  policies:
    - match: { groups: [contractors] }
      cli:
        availableModels: [claude-haiku-4-5]
        # Constrain the Default picker option to availableModels instead of
        # the tier default, so contractors don't get a 400 on the default.
        enforceAvailableModels: true
        # allow auto-approves these tools; it does not block the rest.
        # Add deny rules to restrict tools.
        permissions: { allow: [Read, Grep] }
    - match: {}
      cli:
        availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]
        permissions:
          allow: [Read, Grep, Bash, Edit]
          deny: ["WebFetch"]
        env: { HTTP_PROXY: http://proxy.example.com:8080 }

telemetry:
  forward_to:
    - url: https://otel.internal.example.com:4318
      headers:
        Authorization: Bearer ${OTEL_TOKEN}

​

Client-side managed settings

{
  "forceLoginMethod": "gateway",
  "forceLoginGatewayUrl": "https://claude-gateway.internal.example.com",
  "parentSettingsBehavior": "merge"
}

​

Related

• Claude apps gateway overview: quickstart and developer connection
• Deployment guide: IdP setup, container image, Kubernetes and Cloud Run, and operations
• Spend limits: per-developer caps and the Admin API