Anthropic and AWS have launched the Claude apps gateway, a self-hosted governance layer designed to provide centralized controls for deploying Claude Code and Claude Desktop across enterprise workloads. The gateway enables organizations to manage authentication, model access, cost attribution, and spend enforcement consistently at scale.
TL;DR
- Anthropic and AWS have introduced the Claude apps gateway, a governance layer for managing Claude apps in enterprise environments.
- The gateway provides centralized controls for authentication, model access, cost attribution, and spend enforcement.
- Organizations can deploy the gateway on AWS Fargate, Amazon EKS, or Amazon EC2, with support for various OIDC identity providers.
What happened
The Claude apps gateway is integrated into the same Claude Code CLI binary that developers use. It runs in server mode and loads its YAML configuration at startup. The reference architecture includes components such as compute and state, ingress and private DNS, service connectivity, and upstream credentials.
The gateway supports various OIDC identity providers, including Okta, Microsoft Entra ID, Auth0, Keycloak, and Amazon Cognito. It delegates authentication to the chosen identity provider and issues short-lived bearer tokens for secure access.
The gateway enforces model access server-side and distributes tool permissions as managed settings, scoped by identity provider group. Policies are evaluated in declaration order, with the first match selected and merged onto a catch-all base policy.
Why it matters
The Claude apps gateway addresses critical governance needs for enterprises deploying Claude apps, including centralized authentication, model access control, and spend enforcement. This enables organizations to manage their AI workloads more effectively and securely.
For AI/ML developers, the gateway provides a streamlined authentication process and ensures that only permitted models are accessible, reducing the risk of unauthorized access or usage. For startup founders and tech investors, the gateway offers a robust solution for managing AI workloads at scale, which can be a significant advantage in competitive markets.
Key facts
- The Claude apps gateway is integrated into the Claude Code CLI binary and runs in server mode.
- The gateway supports various OIDC identity providers, including Okta, Microsoft Entra ID, Auth0, Keycloak, and Amazon Cognito.
- The gateway enforces model access server-side and distributes tool permissions as managed settings, scoped by identity provider group.
- The gateway provides per-user usage attribution and telemetry, which can be relayed to various OTLP-compatible backends.
- The gateway supports inference with failover, allowing for automatic failover on upstream unavailability, throttling, or timeouts.
- The gateway enables per-user budget enforcement, with caps set at three levels: organization-wide defaults, per-group, and per-user overrides.
Context
The launch of the Claude apps gateway comes at a time when enterprises are increasingly adopting AI and machine learning technologies to drive innovation and efficiency. However, managing these technologies at scale can be challenging, particularly in terms of governance, security, and cost control.
The Claude apps gateway addresses these challenges by providing a centralized governance layer that enables organizations to manage their AI workloads more effectively. This can be particularly valuable for enterprises in highly regulated industries, where compliance and security are critical concerns.
The gateway also highlights the growing collaboration between AI startups and cloud providers, as they work together to provide enterprises with the tools and infrastructure they need to succeed in the AI-driven future.
