Skip to main content
The Claude apps gateway is designed for organizations that must, or prefer to, route inference through their own cloud provider, for example to meet data residency requirements. If you don’t have this requirement, and want access to other features such as SCIM provisioning or Claude Code on web and mobile, Claude Enterprise may be a better fit. See the feature availability page for a full comparison of all deployment methods.
Claude apps gateway is a self-hosted service that sits between your developers’ Claude Code clients and your model provider. Developers sign in with your corporate identity provider (IdP) instead of holding API keys or cloud credentials. The gateway holds the upstream credential, enforces model access and managed settings by IdP group, and relays usage telemetry to your own observability stack. It is included in the claude binary, so the same executable that runs Claude Code on a laptop runs the gateway server with claude gateway --config gateway.yaml. This page covers: Companion pages go deeper. The configuration reference covers every option in the YAML file the quickstart writes, and the deployment guide covers per-IdP setup, Kubernetes and Cloud Run deployment, and operations.

​
Why Claude apps gateway

The gateway overview covers what a gateway does and why you’d run one. Claude apps gateway is Anthropic’s own gateway, built into the claude binary and tested alongside each Claude Code release, so it forwards the headers and request fields Claude Code sends without operators maintaining a separate allowlist. Once deployed it gives you:
  • Credentials: the upstream API key or cloud credential lives only in your infrastructure. Developers authenticate with corporate SSO and receive short-lived bearer tokens, so offboarding happens in your IdP. Deprovision a user and their gateway access expires within the session lifetime, one hour by default.
  • Access control: your IdP groups map to model allowlists and managed settings policies. The gateway enforces model access server-side, rejecting requests for non-granted models, and selects each group’s managed settings policy, which the CLI applies at the managed settings tier. Different teams get different models, tools, and permissions, and a developer can’t override what their policy locks.
  • Settings delivery: the gateway delivers managed settings to signed-in clients itself, taking the place of server-managed settings from the claude.ai admin console.