What this read moved
1–5 of 5claude-tag/admins/federated-access/troubleshooting Changed · +6 / -6 lines
from line 75
7575
7676## Errors Claude reports in the thread
7777
78When a request from a channel can't be sent with a federated credential, it fails with an HTTP status and a one-line reason, which Claude usually quotes. Reasons with HTTP 403 and 502 end with the connection's name in parentheses, for example `("gateway.example.com")`. The two 503 reasons don't name the connection.
78When a request can't be sent with a federated credential, it fails with an HTTP status and a one-line reason, which Claude usually quotes. Reasons with HTTP 403 and 502 end with the connection's name in parentheses, for example `("gateway.example.com")`. The two 503 reasons don't name the connection.
7979
8080Messages that begin "request blocked" come with HTTP 403. The request was refused on purpose, and retrying won't help. A 503 is temporary. A 502 usually means AWS, Google Cloud, or your authorization server refused the token exchange. A response from your gateway or from the cloud API itself reaches Claude as is, so those show as whatever status the other side returned.
8181
from line 87
8787
8888**What it means**
8989
90Federated connections work only in Slack channels, where Claude acts under your organization's [agent identity](/docs/claude-tag/concepts/agent-identity). The request came from a direct message, or from another session running under a person's own account, which has no agent identity for the token to name.
90Federated connections work only in agent sessions, such as a Slack channel, where Claude acts under your organization's [agent identity](/docs/claude-tag/concepts/agent-identity). The request came from a personal session, such as a [direct message](/docs/claude-tag/concepts/agent-identity#direct-message-channels) with `@Claude`. A personal session runs under a person's own account and has no agent identity for the token to name.
9191
9292**How to resolve**
9393
94Use the connection from a channel whose scope has the bundle attached. No setting enables it in direct messages.
94Use the connection from a channel whose scope has the bundle attached. No setting enables federated connections in personal sessions.
9595
9696### request blocked: this credential's audience isn't registered as a gateway for this organization
9797
claude-tag/admins/federated-access/authorization-server Changed · +4 / -0 lines
from line 104
104104
105105## Verify the connection
106106
107[Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
108
107109In a channel whose workspace or channel has the bundle attached, start a new thread and ask Claude to make a small read:
108110
109111```text wrap theme={null}
from line 129
127129* **"That address is already connected as a gateway. Enter your authorization server's own addresses, or remove the gateway first."**: the token endpoint, or the **Issuer URL** value, is the address of a gateway connected in one of your Access bundles. Enter the server's own addresses, or delete that gateway's connection from its bundle first.
128130
129131For other dialog messages, see [Troubleshoot federated cloud access](/docs/claude-tag/admins/federated-access/troubleshooting).
132
133If Claude reports HTTP 403 with a reason that starts with [`request blocked: this credential only works in channel sessions, not personal ones`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-this-credential-only-works-in-channel-sessions-not-personal-ones), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel under the [scope](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) of the Access bundle that holds the connection.
130134
131135## Related resources
132136
claude-tag/admins/federated-access/aws Changed · +4 / -0 lines
from line 113
113113
114114## Verify the connection
115115
116[Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
117
116118In a channel whose workspace or channel has the bundle attached, start a new thread and ask Claude to run a connectivity check. The check is Claude's own request to `sts.amazonaws.com`, so keep `*.amazonaws.com` under the connection's **Allowed hosts** for this check, or add `sts.amazonaws.com` if you already narrowed the list. The sign-in itself needs no entry there. After the check passes, remove `sts.amazonaws.com` again if you added it, or narrow the wildcard. While it is listed, Claude can send any STS request signed with the role's credentials. If the role is allowed to assume another role, the credentials AWS returns are readable in Claude's sandbox. The call needs no permissions policy on the role. Send Claude this prompt:
117119
118120```text wrap theme={null}
from line 146
144146* **"Enter a role ARN like `arn:aws:iam::123456789012:role/ClaudeTag`"**: the **Role ARN** field rejected the value, most often because the ARN is in the AWS GovCloud (US) or AWS China partition, which can't be connected.
145147
146148For other dialog messages, see [Troubleshoot federated cloud access](/docs/claude-tag/admins/federated-access/troubleshooting).
149
150If Claude reports HTTP 403 with a reason that starts with [`request blocked: this credential only works in channel sessions, not personal ones`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-this-credential-only-works-in-channel-sessions-not-personal-ones), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel under the [scope](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) of the Access bundle that holds the connection.
147151
148152## Related resources
149153
claude-tag/admins/federated-access/connect-a-gateway Changed · +4 / -0 lines
from line 92
9292
9393## Verify the connection
9494
95[Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
96
9597In a channel under the bundle's scope, start a new thread and ask Claude to make a small read through the gateway:
9698
9799```text wrap theme={null}
from line 112
110112* **A bundle-step message that the gateway is already in a bundle**: a gateway can be in one bundle only. [Attach that bundle to the scope](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle) instead.
111113
112114For other dialog messages, see [Troubleshoot federated cloud access](/docs/claude-tag/admins/federated-access/troubleshooting).
115
116If Claude reports HTTP 403 with a reason that starts with [`request blocked: this credential only works in channel sessions, not personal ones`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-this-credential-only-works-in-channel-sessions-not-personal-ones), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel under the [scope](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) of the Access bundle that holds the connection.
113117
114118## Related resources
115119
claude-tag/admins/federated-access/gcp Changed · +4 / -0 lines
from line 123
123123
124124## Verify the connection
125125
126[Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
127
126128In a channel whose workspace or channel has the bundle attached, start a new thread and ask Claude to run a connectivity check. The check reads a bucket's metadata, so the identity needs the `storage.buckets.get` permission on the bucket, and `storage.googleapis.com` must be under the connection's **Allowed hosts**. Send Claude this prompt, replacing `example-reports` with a bucket the identity can read:
127129
128130```text wrap theme={null}
from line 154
152154* **A rejected Workload identity provider or Service account to act as value**: the value doesn't match the form the field describes, usually because the resource name carries the project ID instead of the project number, or the service account is a default one.
153155
154156For other dialog messages, see [Troubleshoot federated cloud access](/docs/claude-tag/admins/federated-access/troubleshooting).
157
158If Claude reports HTTP 403 with a reason that starts with [`request blocked: this credential only works in channel sessions, not personal ones`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-this-credential-only-works-in-channel-sessions-not-personal-ones), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel under the [scope](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) of the Access bundle that holds the connection.
155159
156160## Related resources
157161