One read of Claude Developer Platformapi-20261023T100709Z
143 pages moved out of 820 read.
Pages moved
143
significant first
Pages read
820
in this capture
Captured
10:07 UTC
Corpus hash
1df9c76a5544
corpus-hash
What this read moved
101-125 of 143, page 5 of 6This capture is too large to show at once. Changes 101-125 of 143 are below, significant first; the rest are on the following screens.
cli-sdks-libraries/cli/scripting Changed · +1 / -1 lines
from line 25
2525 --title "Summarization task"
2626 ```
2727
28 ```text Output wrap
28 ```json Output
2929 {
3030 "id": "session_01JZCh78XvmxJjiXVy3oSi7K",
3131 "status": "running"
cli-sdks-libraries/cli/using Changed · +2 / -2 lines
from line 48
4848ant models retrieve --model-id claude-opus-5-5 --format yaml
4949```
5050
51```text Output wrap
51```yaml Output
5252type: model
5353id: claude-opus-5-5
5454display_name: Claude Opus 5.5
from line 74
7474ant beta:agents list --transform "{id,name,model}" --format jsonl
7575```
7676
77```text Output
77```jsonl Output
7878{"id": "agent_011CYm1BLqPX...", "name": "Docs CLI Test Agent", "model": "claude-opus-5-5"}
7979{"id": "agent_011CYkVwfaEt...", "name": "Coffee Making Assistant", "model": "claude-opus-5-5"}
8080{"id": "agent_011CYixHhtUP...", "name": "Coding Assistant", "model": "claude-opus-5-5"}
cli-sdks-libraries/overview Changed · +2 / -2 lines
from line 61
6161| Tool | Latest version | Package |
6262| ---------- | -------------- | ----------------------------------------------------------------------------------------------------------- |
6363| ant CLI | `2.1.0` | [`github.com/anthropics/anthropic-cli`](https://github.com/anthropics/anthropic-cli/releases) |
64| Python | `2.1.0` | [`anthropic`](https://pypi.org/project/anthropic/) |
64| Python | `2.1.0` | [`anthropic` on PyPI](https://pypi.org/project/anthropic/) |
6565| TypeScript | `1.1.0` | [`@anthropic-ai/sdk`](https://www.npmjs.com/package/@anthropic-ai/sdk) |
6666| C# | `13.1.0` | [`Anthropic`](https://www.nuget.org/packages/Anthropic) |
6767| Go | `2.1.0` | [`github.com/anthropics/anthropic-sdk-go/v2`](https://pkg.go.dev/github.com/anthropics/anthropic-sdk-go/v2) |
6868| Java | `3.1.0` | [`com.anthropic:anthropic-java`](https://central.sonatype.com/artifact/com.anthropic/anthropic-java) |
6969| PHP | `1.1.0` | [`anthropic-ai/sdk`](https://packagist.org/packages/anthropic-ai/sdk) |
70| Ruby | `2.1.0` | [`anthropic`](https://rubygems.org/gems/anthropic) |
70| Ruby | `2.1.0` | [`anthropic` on RubyGems](https://rubygems.org/gems/anthropic) |
7171
7272The same versions are available as JSON at `https://platform.claude.com/docs/sdk-versions.json`.
7373
cli-sdks-libraries/sdks/csharp Changed · +1 / -1 lines
from line 324
324324
325325To send a request to the Claude API, build an instance of a `Params` class and pass it to the corresponding client method. When the response is received, it's deserialized into an instance of a C# class.
326326
327For example, `client.Messages.Create` should be called with an instance of `MessageCreateParams`, and it returns an instance of `Task<Message>`.
327For example, `client.Messages.Create` takes an instance of `MessageCreateParams` and returns an instance of `Task<Message>`.
328328
329329## Advanced usage
330330
cli-sdks-libraries/sdks/go Changed · +1 / -1 lines
from line 540
540540
541541## File uploads
542542
543Request parameters that correspond to file uploads in multipart requests are typed as `io.Reader`. The contents of the `io.Reader` are sent by default as a multipart form part with the file name of `anonymous_file` and content type of `application/octet-stream`, so the recommended approach is to specify a custom content type with the `anthropic.File(reader io.Reader, filename string, contentType string)` helper, which wraps any `io.Reader` with the appropriate file name and content type.
543Request parameters that correspond to file uploads in multipart requests are typed as `io.Reader`. The contents of the `io.Reader` are sent by default as a multipart form part with the file name of `anonymous_file` and content type of `application/octet-stream`. For this reason, the recommended approach is to specify a custom content type with the `anthropic.File(reader io.Reader, filename string, contentType string)` helper. This helper wraps any `io.Reader` with the appropriate file name and content type.
544544
545545```go
546546// A file from the filesystem
cli-sdks-libraries/sdks/java Changed · +1 / -1 lines
from line 819
819819
820820To send a request to the Claude API, build an instance of some `Params` class and pass it to the corresponding client method. When the response is received, it is deserialized into an instance of a Java class.
821821
822For example, `client.messages().create(...)` should be called with an instance of `MessageCreateParams`, and it returns an instance of `Message`.
822For example, `client.messages().create(...)` takes an instance of `MessageCreateParams` and returns an instance of `Message`.
823823
824824### Undocumented parameters
825825
cli-sdks-libraries/sdks/python Changed · +1 / -1 lines
from line 611
611611print(message.content)
612612```
613613
614These methods return an `APIResponse` object. On the async client they return an `AsyncAPIResponse`, and `.parse()`, `.read()`, `.text()`, and `.json()` must be awaited.
614These methods return an `APIResponse` object. On the async client they return an `AsyncAPIResponse`, and you must await `.parse()`, `.read()`, `.text()`, and `.json()`.
615615
616616### Streaming response body
617617
get-started Changed · +2 / -2 lines
from line 44
4444
4545 Claude returns a JSON response containing the assistant's message:
4646
47 ```text Output
47 ```json Output
4848 {
4949 "model": "claude-opus-5-5",
5050 "id": "msg_013mHbppMPd2PrVJzGMZPt2D",
from line 112
112112
113113 The CLI prints the JSON response:
114114
115 ```text Output
115 ```json Output
116116 {
117117 "model": "claude-opus-5-5",
118118 "id": "msg_01N1ycuCkM5Mzd7WhTU4fwST",
manage-claude/authentication Changed · +2 / -2 lines
from line 311
311311
312312If a request made with a key that isn't scoped to a workspace omits the header, the API returns a 400 `invalid_request_error`:
313313
314```text JSON
314```json JSON
315315{
316316 "type": "error",
317317 "error": {
from line 354
354354
355355## Workload Identity Federation
356356
357Workload Identity Federation (WIF) lets a workload authenticate with a short-lived identity token issued by an identity provider (IdP) you already trust, such as AWS IAM, Google Cloud, or any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its IdP-issued JWT at `POST /v1/oauth/token` for a short-lived Claude API access token, and the SDK refreshes that token automatically before it expires. There is no `sk-ant-api...` string to mint, distribute, or rotate.
357Workload Identity Federation (WIF) lets a workload authenticate with a short-lived identity token issued by an identity provider (IdP) you already trust. Such IdPs include AWS IAM, Google Cloud, and any standards-compliant OIDC issuer (such as GitHub Actions, Kubernetes service accounts, SPIFFE, Microsoft Entra ID, or Okta). The workload exchanges its IdP-issued JWT at `POST /v1/oauth/token` for a short-lived Claude API access token, and the SDK refreshes that token automatically before it expires. There is no `sk-ant-api...` string to mint, distribute, or rotate.
358358
359359Federation removes long-lived Claude API keys from your environment, which limits the damage that a leaked credential can cause and lets you manage access with the same IdP controls you already use for cloud resources. It does not, on its own, guarantee end-to-end security: the trust chain is only as strong as your identity provider's configuration, and a long-lived secret one step earlier in that chain (for example, a static cloud credential that can mint IdP tokens) can still undermine it. Pair federation with your provider's controls, such as IP allowlists, MFA, and audit logging.
360360
manage-claude/claude-code-analytics-api Changed · +1 / -1 lines
from line 147
147147
148148The API returns data in the following format:
149149
150```text wrap
150```json
151151{
152152 "data": [
153153 {
manage-claude/compliance-api-access Changed · +1 / -1 lines
from line 129
129129* **Settings UI.** For a Compliance Access Key, open the **Keys** section in [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) and read the **Scopes** column for the key. Admin API keys, listed on the [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console, have no selectable scopes.
130130* **Error responses.** A call that exceeds the key's scopes returns a 403 with a message in the format `Missing required scopes. Got: [<scopes the key carries>] Needed one of: [<scopes the endpoint accepts>]` (`Needed: [...]` on the delete endpoints). See [Handle Compliance API errors](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden) for the full error catalog.
131131
132```text
132```json
133133{
134134 "error": {
135135 "type": "permission_error",
manage-claude/compliance-faq Changed · +1 / -1 lines
from line 43
4343 <Accordion title="Why does my Admin API key return 403 on chat or file endpoints?">
4444 An Admin API key's only Compliance API scope is `read:compliance_activities`, which authorizes the Activity Feed only. Every other Compliance API endpoint requires a scope that only a Compliance Access Key created in claude.ai can carry. Calling a content or directory endpoint with an Admin API key returns a 403 naming the scope that endpoint family requires: `read:compliance_user_data` for chats, files, projects, project attachments, sessions, users, and group members, and `read:compliance_org_data` for organizations, roles, groups, and effective organization settings. For example, listing chats returns the following response.
4545
46 ```text Response
46 ```json Response
4747 {
4848 "error": {
4949 "type": "permission_error",
manage-claude/compliance-integration-patterns Changed · +1 / -1 lines
from line 67
6767 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
6868 -H "anthropic-version: 2023-06-01" \
6969 --data-urlencode "limit=5000" \
70 --data-urlencode "before_id=activity_01XyDMpzjS89pFZXqSFUBDr6"
70 --data-urlencode "before_id=activity_01DeFgHjKmNpQrStUvWxYzAb"
7171```
7272
7373Page through until `has_more` is `false`, then persist `first_id` from the final response and pass it unchanged as `before_id` on the next run to retrieve activities newer than the saved cursor. To walk in the opposite direction for a backfill, persist `last_id` and pass it as `after_id` instead. For the full cursor-versus-page-token reference and retry semantics, see [Paginate results](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed#paginate-results).
manage-claude/data-residency Changed · +1 / -1 lines
from line 208
208208
209209The response `usage` object includes an `inference_geo` field indicating where inference ran:
210210
211```text Output wrap
211```json Output
212212{
213213 "usage": {
214214 "input_tokens": 25,
manage-claude/inference-hooks-endpoint Changed · +2 / -2 lines
from line 14
1414
1515## Get a first verdict round trip
1616
17The smallest working integration is a server that reads each request and allows it. Run one of the following servers, expose it at a public `https://` URL (for example, behind a TLS-terminating reverse proxy on a host you control, not a reverse-tunnel service; see [Receive a request](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#receive-a-request)), then have your administrator [set it as the endpoint and test the connection](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration): the **Test connection** result reports the allow verdict your server returned.
17The smallest working integration is a server that reads each request and allows it. Run one of the following servers and expose it at a public `https://` URL. For example, put it behind a TLS-terminating reverse proxy on a host you control, not a reverse-tunnel service (see [Receive a request](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#receive-a-request)). Then have your administrator [set it as the endpoint and test the connection](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration). The **Test connection** result reports the allow verdict your server returned.
1818
1919<CodeGroup exclude="shell">
2020 ```python Python
from line 148
148148
149149Anthropic sends an HTTPS `POST` to the URL your administrator configures. The whole configured URL is the endpoint: there is no fixed path suffix, so choose any path that suits your server.
150150
151Host your AI security server where Anthropic can reach it: an `https://` URL on port 443, on a publicly routable host (private, loopback, and carrier-grade NAT ranges are refused at connect time), with a certificate that validates against the public CA trust store, responding without redirects. The host must have an IPv4 address, which Anthropic uses even when the host also has IPv6 addresses; a URL whose host is `localhost` or an IPv6 address is refused. The configured URL must be the final destination. Reverse-tunnel hosts (ngrok and similar tunnel services) are not supported: Anthropic's network policy blocks them. Host your server on a domain you control. [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) covers how your administrator sets and tests the URL.
151Host your AI security server where Anthropic can reach it: an `https://` URL on port 443, on a publicly routable host. Private, loopback, and carrier-grade NAT ranges are refused at connect time. The server must have a certificate that validates against the public CA trust store, and it must respond without redirects. The host must have an IPv4 address, which Anthropic uses even when the host also has IPv6 addresses; a URL whose host is `localhost` or an IPv6 address is refused. The configured URL must be the final destination. Reverse-tunnel hosts (ngrok and similar tunnel services) are not supported: Anthropic's network policy blocks them. Host your server on a domain you control. [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) covers how your administrator sets and tests the URL.
152152
153153Every request carries these fixed headers, along with any [custom request headers](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration) your administrator configured and, once your organization has a signing secret, the `webhook-*` signature headers described in [Verify the signature](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#verify-the-signature):
154154
manage-claude/opentelemetry Changed · +1 / -1 lines
from line 121
121121 </Card>
122122
123123 <Card title="Snowflake" image="https://platform.claude.com/docs/images/partner-logos/snowflake.svg" imageHeight={30} imageOffsetLeft={2} href="https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-ai-gateway/observability#trace-claude-requests">
124 AI Data Cloud.
124 Agentic control plane with built-in observability and governance.
125125 </Card>
126126
127127 <Card title="Splunk" image="https://platform.claude.com/docs/images/partner-logos/splunk.svg" imageDark="https://platform.claude.com/docs/images/partner-logos/splunk-dark.svg" imageHeight={27} imageOffsetLeft={1} href="https://agent-observability-docs.splunk.com/sdk-api/third-party-integrations/claude">
manage-claude/organization-webhooks Changed · +2 / -2 lines
from line 85
8585| `updated_at` | string | When the endpoint last changed. Set by Anthropic. |
8686| `signing_secret` | string | A `whsec_`-prefixed secret, created with the endpoint. Only the responses that create the endpoint or replace the secret include it, so store it securely. |
8787
88```text wrap
88```json
8989{
9090 "id": "wep_011CZkZDf8HnUq2mTxRbVn4s",
9191 "url": "https://example.com/anthropic-webhooks",
from line 232
232232
233233With no endpoints, the API returns an empty list:
234234
235```text wrap
235```json
236236{
237237 "data": [],
238238 "has_more": false
manage-claude/spend-limits-api Changed · +2 / -2 lines
from line 372
372372 ```
373373</CodeGroup>
374374
375```text wrap
375```json
376376{
377377 "data": [
378378 {
from line 625
625625 ```
626626</CodeGroup>
627627
628```text wrap
628```json
629629{
630630 "type": "spend_limit",
631631 "id": "spl_01RsTuVwXyZaBcDeFgHiJk",
manage-claude/user-profiles Changed · +2 / -2 lines
from line 181
181181
182182The response is the new profile:
183183
184```text wrap
184```json
185185{
186186 "type": "user_profile",
187187 "id": "uprof_011CZkZCu8hGbp5mYRQgUmz9",
from line 403
403403
404404A profile's `enforcement_status` and `enforcement_actions` fields report the enforcement actions that Anthropic has open on the end customer. An enforcement action is a restriction or a ban. Every response that returns a profile includes both fields: create, retrieve, update, and each profile in a list. Send these requests with no `user-profiles-` value in the `anthropic-beta` header, because `user-profiles-2026-09-04` and earlier values leave the fields out. The following example shows the fields on a retrieved profile, with the other fields left out:
405405
406```text wrap
406```json
407407{
408408 "type": "user_profile",
409409 "id": "uprof_011CZkZCu8hGbp5mYRQgUmz9",
manage-claude/user-profiles-verification-portal Changed · +1 / -1 lines
from line 127
127127
128128The response contains the link and the time it stops working:
129129
130```text wrap
130```json
131131{
132132 "type": "user_profile_action_url",
133133 "url": "https://portal.anthropic.com/enroll?enrollment_token=...",
manage-claude/wif-providers/aws Changed · +2 / -2 lines
from line 480
480480JSON
481481```
482482
483A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common AWS-side cause is an `iss` mismatch (the per-account STS issuer URL must match the registered `issuer_url` exactly).
483A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common AWS-side cause is an `iss` mismatch: the per-account STS issuer URL must match the registered `issuer_url` exactly.
484484
485485## Use EKS projected service-account tokens
486486
from line 835
835835JSON
836836```
837837
838A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).
838A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).
839839
840840## Scope your rule
841841
manage-claude/wif-providers/azure Changed · +2 / -2 lines
from line 623
623623
624624## Use Entra Workload Identity on AKS
625625
626Use this path when your workload runs in an AKS pod. Entra Workload Identity federates a Kubernetes service account with a user-assigned managed identity: Kubernetes projects a service account token (signed by the AKS cluster's OIDC issuer) into the pod at the path in `AZURE_FEDERATED_TOKEN_FILE`. That projected token is not an Entra-issued token, so to stay on the Entra-mediated path described on this page, the workload performs a two-hop exchange: it first redeems the projected token at `https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token` (federated `client_credentials` grant) for an Entra-issued access token, then passes that Entra token to the Anthropic SDK as the identity token.
626Use this path when your workload runs in an AKS pod. Entra Workload Identity federates a Kubernetes service account with a user-assigned managed identity: Kubernetes projects a service account token (signed by the AKS cluster's OIDC issuer) into the pod at the path in `AZURE_FEDERATED_TOKEN_FILE`. That projected token is not an Entra-issued token, so to stay on the Entra-mediated path described on this page, the workload performs a two-hop exchange. First, it redeems the projected token at `https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token` (federated `client_credentials` grant) for an Entra-issued access token. Then it passes that Entra token to the Anthropic SDK as the identity token.
627627
628628<Tip>
629629 AKS pods can alternatively skip the Entra exchange and present the Kubernetes-projected service account token to Anthropic directly. That path registers your AKS cluster's OIDC issuer with Anthropic instead of your Entra tenant. See [Use WIF with Kubernetes](https://platform.claude.com/docs/en/manage-claude/wif-providers/kubernetes) for that flow.
from line 1241
12411241
12421242### Verify the setup
12431243
1244From inside a labeled pod, run the cURL exchange shown in [Acquire and use the token on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#acquire-and-use-the-token-2) and confirm that `POST /v1/oauth/token` returns a `200` with an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason, then decode the Entra-issued token from step 1 (see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) for the command) and check the most common Azure-side causes:
1244From inside a labeled pod, run the cURL exchange shown in [Acquire and use the token on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#acquire-and-use-the-token-2) and confirm that `POST /v1/oauth/token` returns a `200` with an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason. Then decode the Entra-issued token from step 1 (see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange) for the command) and check the most common Azure-side causes:
12451245
12461246* **Issuer mismatch:** The registered `issuer_url` must match the token's `iss` claim exactly. A v2.0 token carries `https://login.microsoftonline.com/<TENANT_ID>/v2.0`; if the decoded `ver` claim is `1.0`, see [If your tokens are v1.0](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#if-your-tokens-are-v1-0).
12471247* **Token lifetime:** If a tenant token-lifetime policy or CAE extends the `client_credentials` token past 7,500 seconds, raise the issuer's `max_jwt_lifetime_seconds` as described in [Configure Anthropic for Entra Workload Identity on AKS](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#configure-anthropic-2).
manage-claude/wif-providers/gcp Changed · +1 / -1 lines
from line 465
465465 | jq -rR 'split(".")[1] | gsub("-";"+") | gsub("_";"/") | @base64d | fromjson'
466466```
467467
468Check that `iss` is `https://accounts.google.com`, `aud` is `https://api.anthropic.com`, and `email` matches the value in your federation rule. Then run the exchange from the previous section. A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Google Cloud-side cause is the `email` claim missing (request the token with `format=full` so it is included).
468Check that `iss` is `https://accounts.google.com`, `aud` is `https://api.anthropic.com`, and `email` matches the value in your federation rule. Then run the exchange from the previous section. A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Google Cloud-side cause is the `email` claim missing (request the token with `format=full` so it is included).
469469
470470## Scope your rule
471471
manage-claude/wif-providers/kubernetes Changed · +1 / -1 lines
from line 291
291291
292292## Verify the setup
293293
294A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Kubernetes-side cause is a JWKS key mismatch (for `inline` mode, re-fetch with `kubectl get --raw /openid/v1/jwks` and update the issuer).
294A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Kubernetes-side cause is a JWKS key mismatch (for `inline` mode, re-fetch with `kubectl get --raw /openid/v1/jwks` and update the issuer).
295295
296296## Scope your rule
297297
manage-claude/wif-providers/okta Changed · +1 / -1 lines
from line 496
496496
497497## Verify the setup
498498
499A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common Okta-side cause is an `issuer_url` mismatch (it must include the `/oauth2/<auth-server-id>` path; the Okta org authorization server is not usable).
499A successful exchange returns an `access_token` starting with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange). The most common Okta-side cause is an `issuer_url` mismatch. The `issuer_url` must include the `/oauth2/<auth-server-id>` path, and the Okta org authorization server is not usable.
500500
501501## Scope your rule
502502