Gateway operations

There are two operational forms: administrator-hosted apps gateway for organizational access, and generic LLM gateways such as Passion8 forwarding Anthropic Messages from ANTHROPIC_BASE_URL.

See protocol checklist for forwarding, errors, discovery and caching; see provider guidance for user authentication variables.

#Official apps gateway

Administrators host it with the claude binary:

claude gateway --config gateway.yaml

No separate application framework is required. Configure identity, policy, database, telemetry and routing, with login behind VPN, private DNS or controlled proxy.

#gateway.yaml example

This operational outline illustrates configuration areas. Use the current gateway schema for exact field names.

server:
  listen: "0.0.0.0:8443"
  public_url: "https://claude-gateway.internal.example.com"

auth:
  oidc:
    issuer_url: "https://idp.internal.example.com"
    client_id: "claude-apps-gateway"
    client_secret_env: "CLAUDE_GATEWAY_OIDC_CLIENT_SECRET"
    allowed_groups:
      - "engineering"
      - "support"

database:
  postgres:
    url_env: "CLAUDE_GATEWAY_DATABASE_URL"

policies:
  managed:
    enabled: true
    default_policy: "engineering-default"

telemetry:
  otlp:
    endpoint: "https://otel.internal.example.com/v1/traces"
    headers_env: "CLAUDE_GATEWAY_OTEL_HEADERS"

upstreams:
  - name: "anthropic"
    type: "anthropic"
    base_url: "https://api.anthropic.com"
    api_key_env: "ANTHROPIC_API_KEY"
  - name: "passion8"
    type: "anthropic"
    base_url: "https://passion8.cc"
    auth_token_env: "PASSION8_API_KEY"

routing:
  default_upstream: "anthropic"
  rules:
    - group: "support"
      upstream: "passion8"
      models:
        - "claude-sonnet-5-5"

spend_limits:
  defaults:
    user_daily_usd: 10
    team_monthly_usd: 1000
  on_exceeded: "deny"

#Generic LLM gateway protocol

Code still sends Anthropic Messages through Passion8/custom gateways. Set the root in ANTHROPIC_BASE_URL and provide compatible paths.

Use extensible validation rather than a minimal fixed schema. Preserve these fields and explicitly forward or reject new beta fields:

#System arrays and attribution

Preserve system array block order, types and nested fields, including the attribution block's position.

Prefer managed/provider policy. If rewriting is unavoidable, preserve attribution ordering and audit the transformation.

#Model discovery

Enable gateway models in the picker with:

export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1

Discovery request:

GET /v1/models?limit=1000

Operational constraints:

Return stable, lightweight, noninteractive model JSON; never redirect discovery to an IdP or login page.

#One-hour prompt caching

A client variable alone cannot guarantee one-hour caching. Verify:

Document and observe five-minute fallback if one hour is unsupported. Never fabricate hits through body rewriting.

#Spend limits

Consider budgets at gateway and provider levels:

Do not silently substitute a cheaper, different model after a limit unless policy and UI explicitly explain it. Silent fallback complicates debugging, cost attribution and auditing.

#Server-managed settings limitations

Official settings depend on Anthropic identities and policy services. Do not assume they govern third-party providers or deliver custom gateway URLs/tokens.

#Passion8/custom gateway checklist

#curl self-checks

claude-sonnet-5-5 is a current official example ID. Verify Passion8 access first or substitute an enabled console model.

Set environment variables first:

export ANTHROPIC_BASE_URL="https://passion8.cc"
export ANTHROPIC_AUTH_TOKEN="sk-..."
export ANTHROPIC_MODEL="claude-sonnet-5-5"

Messages JSON:

curl -sS "$ANTHROPIC_BASE_URL/v1/messages" \
  -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "'"$ANTHROPIC_MODEL"'",
    "max_tokens": 64,
    "messages": [
      { "role": "user", "content": "Reply only ok" }
    ]
  }'

SSE stream:

curl -N "$ANTHROPIC_BASE_URL/v1/messages" \
  -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "'"$ANTHROPIC_MODEL"'",
    "max_tokens": 64,
    "stream": true,
    "messages": [
      { "role": "user", "content": "stream ok" }
    ]
  }'

Test discovery within the client-like three-second budget:

curl -sS --max-time 3 "$ANTHROPIC_BASE_URL/v1/models?limit=1000" \
  -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
  -H "anthropic-version: 2023-06-01"

Optional token count:

curl -sS "$ANTHROPIC_BASE_URL/v1/messages/count_tokens" \
  -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "'"$ANTHROPIC_MODEL"'",
    "messages": [
      { "role": "user", "content": "count tokens" }
    ]
  }'

Expected checks:

#Official references

• Claude apps gateway deployment and operations
• Deploy Claude apps gateway on Google Cloud
• Run Claude Code through a gateway

#Related pages