One read of Claude Documentationclaude-docs-20261013T150705Z
2 pages moved out of 265 read.
Pages moved
2
significant first
Pages read
265
in this capture
Captured
15:07 UTC
Corpus hash
dde8ceb2575d
corpus-hash
What this read moved
1-2 of 2office-agents/data-storage Changed · +138 / -43 lines
## Every Claude for M365 add-in shares one store ## Every Claude add-in shares one store
from line 4
44
55Claude for M365 stores chat history, uploaded skills, connector registrations,
66and sign-in credentials on each user's own device, in the browser storage of
7the webview that Office provides. Anthropic holds no copy of this data, and
8nothing syncs between devices or browsers.
7the webview that Office provides. Anthropic does not back up this data, and
8nothing syncs between devices or browsers. Some of it still leaves the device
9while the add-in is in use, as
10[What leaves the device](#what-leaves-the-device) describes.
911
1012A device that is rebuilt, reimaged, or handed to someone else loses this data
1113unless you export it first.
1214
13## Every Claude add-in shares one store
15## Every Claude for M365 add-in shares one store
1416
15Users run more than one Claude add-in over time: the per-app store listings, an
16enterprise sideload, or a custom manifest that points the add-in at your own
17cloud. All of them are served from `https://pivot.claude.ai`, and browser
18storage is keyed to that address. They
19therefore read and write the same store on a given device.
17Users run more than one Claude for M365 add-in over time: the per-app store
18listings, an enterprise sideload, or a custom manifest that points the add-in at
19your own cloud. All of them are served from `https://pivot.claude.ai`, and
20browser storage is keyed to that address. They therefore read and write the same
21store on a given device.
2022
21<img src="https://mintcdn.com/claude-ai/eVVCEXIWAP0OYny8/images/office-agents/data-storage/storage-shared.png?fit=max&auto=format&n=eVVCEXIWAP0OYny8&q=85&s=ce3348a4909a88501ddad9de36cfd151" alt="Separate Claude add-in installs, each with its own add-in ID, all served from pivot.claude.ai and sharing one store that holds five IndexedDB databases and local storage" width="2506" height="856" data-path="images/office-agents/data-storage/storage-shared.png" />
23<img src="https://mintcdn.com/claude-ai/eVVCEXIWAP0OYny8/images/office-agents/data-storage/storage-shared.png?fit=max&auto=format&n=eVVCEXIWAP0OYny8&q=85&s=ce3348a4909a88501ddad9de36cfd151" alt="Separate Claude for M365 add-in installs, each with its own add-in ID, all served from pivot.claude.ai and sharing one store that holds the add-in's IndexedDB databases and local storage" width="2506" height="856" data-path="images/office-agents/data-storage/storage-shared.png" />
2224
2325The reason is the ordinary web rule. Office reads the manifest, finds the
2426`<SourceLocation>` URL, and opens it in an embedded browser. From that point the
from line 56
5456
5557## What Claude for M365 stores
5658
57The add-in uses five IndexedDB databases and one local storage store, all inside
58the signed-in user's operating system profile. The table below lists each one
59and what it is scoped to.
59The table below lists the add-in's IndexedDB databases and its local storage,
60all inside the signed-in user's operating system profile, with what each one
61holds and what it is scoped to.
6062
6163| Store | Contents | Scoped to |
6264| - | - | - |
63| `claude-chat-history` | Conversation transcripts, titles, timestamps, and the contents of attached files | One user, one organization, one Office app |
65| `claude-chat-history` | Conversation transcripts with their titles and timestamps, and some files in full. A transcript includes the document, email, and calendar content that Claude read. The add-in keeps images, PDFs, `.pptx` files, and `.potx` files that a user attaches, and every file that a user attaches to the chat in Outlook or in a third-party platform deployment. It also keeps any other file that Claude downloads to the device to work with, the files of skills a conversation used, and files returned by connectors, as well as data that Claude saves while it works. These files and data can include document content and, in Outlook, email and calendar data from Microsoft Graph. Each saved conversation also keeps the name, type, and size of every attached file and, in Excel, Word, and PowerPoint, the document's file path or URL | One user, one organization, one Office app |
6466| `claude-local-skills` | Skills the user uploaded, including any templates bundled with them | The device profile, not the individual user |
65| `claude-mcp-gateways` | Client registrations for connectors the user has authorized | The connector's address, not the individual user |
67| `claude-mcp-gateways` | Client registrations, and access and refresh tokens, for connectors the user has authorized | The connector's address, not the individual user |
6668| `claude-mail-style` | Claude for Outlook only: learned writing style, draft preferences, and scratchpad | One user |
67| `claude-office-snipped-results` | Working scratch for long conversations, cleared at the start of every session | Nothing, transient |
69| `claude-memory` | Only with a Claude account sign-in, and only when memory is on: notes that Claude saves so it can use them in later conversations, such as the user's role, their feedback on Claude's work, and details of their projects. A note can include content from a document Claude read. Each note holds its file name, its text, the user's ID, and the time it was last changed | One user |
70| `claude-office-inflight` | Crash-detection records. There is one record for each add-in pane that is running a tool call. It holds a random ID for the pane, the conversation's ID, the tool's name, the Office app and its version, the start time, and, in Excel, Word, and PowerPoint, the document's file path or URL if it had one when the add-in opened. When the add-in opens and finds a record from a call that began more than 10 minutes earlier, which usually means Office or the add-in closed during the call, it sends a usage event for that record and deletes it. The event carries the pane's and the conversation's IDs, the Office app and its version, the time from the call's start until the record was found, and the tool's name, with a connector's tool reported only as a connector tool. It does not carry the document's path. [Data retention](#data-retention) gives when each record is deleted | The device profile, not the individual user |
71| `claude-office-snipped-results` | Parts of the current conversation that were moved out of Claude's working context, which can include document content. A saved conversation keeps its own copy in `claude-chat-history`. [Data retention](#data-retention) gives when this store is emptied | The device profile, not the individual user |
6872| Local storage | Settings, onboarding and terms flags, and the active sign-in profile | The browser profile |
6973
70Conversations and the Outlook writing style guide are scoped to the
71individual user. Uploaded skills and connector registrations are scoped to the
72storage location instead, so anyone who reaches the same store shares them. The
73Windows and macOS sections below describe what splits a store on each platform.
74Conversations, memory notes, and the Outlook writing style guide are scoped to
75the individual user. Uploaded skills, connector registrations, crash-detection
76records, and conversation parts moved out of Claude's working context are
77scoped to the storage location instead, so anyone who reaches the same store
78shares them. The Windows and macOS sections below describe what splits a store
79on each platform.
7480
7581This only applies where people share a single operating system account. That
7682arrangement already shares the browser profile, saved sessions, and local files
from line 90
8490
8591## Sign-in and credentials
8692
87Every store above holds only content, with one exception. Local storage also
88holds the signed-in user's identity: the credential the add-in presents to the
89model endpoint you configured. Cloud provider sign-ins use short-lived tokens
90that the add-in renews automatically. A gateway token or API key that you
91configure yourself is held until you change it.
93Every store above holds only content, with two exceptions. Local storage holds
94the signed-in user's identity: the credential the add-in presents to the model
95endpoint you configured. `claude-mcp-gateways` holds an access token, and a
96refresh token when the connector issues one, for each connector that your
97deployment configures and the user has authorized.
9298
93This sits in the browser profile unencrypted, in the same way a saved web
94session does. The boundary protecting it is the operating system account:
95another account on the same machine cannot read it, and disk encryption covers
96the device at rest. Where the deployment signs in to a cloud provider, the
97credential is obtained on the device and used from the device. A gateway token
99Local storage also holds the Microsoft Entra ID tokens that Microsoft's sign-in
100library keeps for the add-in, such as the token that Claude for Outlook uses to
101call Microsoft Graph.
102
103What the credential is depends on how users sign in:
104
105* A Claude account sign-in stores an access token, and a refresh token that the
106 add-in uses to get a new access token.
107* A Vertex AI sign-in stores a Google refresh token with the `cloud-platform`
108 scope, and the OAuth client ID and client secret that you configured.
109* An Amazon Bedrock sign-in stores the user's Entra ID token and sign-in name,
110 and short-lived AWS credentials. A Foundry sign-in through Microsoft Entra ID
111 stores a short-lived Entra ID access token for the resource that your
112 manifest's Entra scope names. The add-in renews both automatically.
113* A gateway token or API key that you configure yourself is held until you
114 change it. A gateway token from a bootstrap endpoint is fetched again each
115 time the add-in loads, shortly before any expiry that the endpoint declares,
116 and after the gateway rejects a request as unauthorized.
117
118Where Office provides storage for the add-in, the add-in also writes a second
119copy of the sign-in there, and reads it back when the browser copy is missing.
120Signing out deletes both copies of the sign-in, and the connector tokens, from
121the storage that the add-in is using. Other Claude task panes that share that
122storage sign out too. On macOS each Office app has its own storage, and on
123Windows two Office apps can have separate storage. An Office app with its own
124storage keeps its sign-in and connector tokens until the user signs out there
125too. Signing out does not delete the tokens that Microsoft's sign-in library
126keeps.
127
128Signing out also asks Anthropic to revoke the Claude account sign-in that the
129task pane holds, and a sign-in that
130[serves add-in settings from your Claude organization](/docs/office-agents/third-party-platforms#serve-add-in-settings-from-your-claude-organization),
131so that they cannot be used to get new access tokens. The add-in sends this
132request once and does not try again if it fails. A separate Claude sign-in in
133an Office app with its own storage is not revoked. Signing out does not revoke
134any other credential with the service that issued it. That includes the
135connector tokens, the tokens that Microsoft's sign-in library keeps, Vertex AI,
136Amazon Bedrock, and Foundry sign-ins, and a gateway token or API key.
137
138The add-in does not encrypt these credentials. The boundary protecting the
139browser copy is the operating system account: a standard account on the same
140machine cannot read it, an administrator account can, and disk encryption,
141where the device uses it, covers the device at rest. Where the deployment signs
142in to a cloud provider, the credential is obtained on the device and used from
143the device. A gateway token
98144or API key that you issue centrally is distributed to every user's device, so
99145treat it as you would any other shared secret.
100146
from line 147
101147<Warning>
102148 An export of a user's add-in data contains these credentials as well as
103149 conversation text, because the export copies local storage. Treat an export
104 folder as a secret, or delete the local storage folder from it before the export
105 leaves the device. A rebuilt machine signs in again regardless.
150 folder as a secret. It also holds the connector tokens from
151 `claude-mcp-gateways`, so deleting only its local storage folder does not
152 remove every credential. A rebuilt machine signs in again regardless.
106153</Warning>
107154
108155## Where the data sits on Windows
from line 188
141188When users sign in with a Claude account, that account is the identity. In
142189third-party platform deployments there is no Claude account, so the identity
143190comes from the Microsoft Entra ID sign-in already present in Office, as a
144one-way hash of the directory object ID. Nothing about the user is stored in
145readable form, and the hash is not sent to Anthropic.
191one-way hash of the directory object ID. The history key holds nothing about
192the user in readable form. The hash is the same for that user on every device, and
193usage events include it, as described in
194[What leaves the device](#what-leaves-the-device).
146195
147196Office builds without support for nested app authentication cannot supply the
148197Entra ID sign-in the add-in reads. On those builds Claude for M365 falls back to
from line 218
169218
170219## Data retention
171220
172Claude for M365 bounds local storage in two ways, and users can clear it
173themselves at any time.
221The table below shows how long Claude for M365 keeps each kind of local data.
222Users can also delete their saved conversations at any time, as described after
223the table.
174224
175225| Store | Retention |
176226| - | - |
177227| `claude-chat-history` | The 50 most recent conversations per user, per organization, per Office app. Older conversations are deleted automatically |
178228| Any store | When the browser profile runs out of storage quota, the oldest conversations are deleted to make room |
179| `claude-office-snipped-results` | Cleared at the start of every session |
229| `claude-memory` | A note is kept until it is deleted or the browser profile is wiped. Claude can delete a note, for example when the user asks it to forget something. When Claude saves a note, the chat shows a notice with an Undo button, which removes the note or restores its earlier text. There is no setting to view or delete notes, and deleting saved conversations does not delete notes |
230| `claude-office-inflight` | Each record is deleted when its tool call ends, or when the user stops Claude, starts a new chat, or opens a saved conversation. It is also deleted while Claude waits for the user to answer a question or approve an action, and written again afterwards. If Office or the add-in closes or reloads during the call, the record is deleted the next time a Claude for M365 add-in that uses the same store opens, once more than 10 minutes have passed since the call began |
231| `claude-office-snipped-results` | Emptied when the user starts a new chat or deletes all chats. Replaced with a saved conversation's parts when a saved conversation is opened. Content left when the add-in closes stays until Claude next moves content out of its working context or asks for moved content back, a saved conversation is opened, or a new chat starts |
180232| Everything else | Kept until the user deletes it or the browser profile is wiped |
181233
182234Users clear their own conversations from the add-in's settings. Under "Chat
from line 249
197249| Data | Where it goes |
198250| - | - |
199251| Conversation text, attachments, and the document content Claude is asked to work with | The model endpoint your deployment is configured for. In third-party platform deployments that is your own Vertex AI, Bedrock, Azure, or gateway endpoint |
200| Chat history, uploaded skills, connector registrations, and the Outlook writing style guide | Nowhere. Local only, no sync, no server-side backup |
201| Sign-in credentials | Only to the identity provider they belong to |
202| Usage telemetry sent to Anthropic | Counts, durations, and error categories. Anthropic's collector is allowlist-filtered, so it excludes conversation text, document contents, file names, and the names of your connectors and their tools |
203| Telemetry sent to a custom OpenTelemetry collector you configure | The full audit trail, including prompt content and tool inputs and outputs. That path bypasses the allowlist filter by design. See [Audit and observability](/docs/office-agents/enterprise-readiness#audit-and-observability) |
252| Files that a user attaches, with a Claude account sign-in | Uploaded to Anthropic with the user's Claude sign-in when the user attaches them, before the message is sent. Each file expires 28 days after the add-in uploads it. If Anthropic does not accept an expiry for the user's organization, the add-in uploads the file with no expiry. The add-in does not delete files itself. Earlier versions of the add-in set no expiry on the files they uploaded. The add-in started setting an expiry on September 15, 2026 |
253| Chat history, uploaded skills, and connector registrations | Not synced between devices and not backed up on any server. The add-in still sends their contents to the model endpoint when Claude uses them, as the rows above describe. Every chat request includes the name and description of each skill that is turned on. With a Claude account sign-in, it also includes the name and description of each plugin the user has turned on, with the names of its skills and connectors, and the organization's Claude settings can turn skills off, which stops both. When Claude uses a skill, the add-in also sends the skill's instructions and Markdown files. With a Claude account sign-in, files attached in a chat are also uploaded to Anthropic |
254| Claude for Outlook writing style guide, draft preferences, and scratchpad | Not synced between devices and not backed up on any server. To build the style guide and the draft preferences, the add-in sends recent sent mail, with the first recipient's address of each message, and the user's edits to drafts to the model endpoint. After that, every Outlook chat request includes the style guide and the draft preferences, and every message the user sends in Outlook includes the scratchpad |
255| Sign-in credentials | To the services the sign-in is for, with two exceptions described last. A Bedrock sign-in sends the Entra ID token to AWS, which exchanges it for short-lived credentials. A Claude account token also goes to `claude.ai` with feature-flag requests. The exceptions: a credential that you put in the query string of the manifest URL also reaches Anthropic's server at `pivot.claude.ai` each time the add-in loads, and the server's request logs record it. A Vertex AI sign-in also returns Google's one-time authorization code to `pivot.claude.ai` in the query string, where request logs can record it. The code cannot be exchanged for a token without your OAuth client secret, so keep the client secret out of the manifest URL query string too. See [Keep credentials out of the manifest URL query string](/docs/office-agents/third-party-platforms#keep-credentials-out-of-the-manifest-url-query-string) |
256| Identifiers on model requests | Each request for a model response carries the name of the add-in, a random identifier for the device, and a session ID. For a chat message, the session ID is the conversation's ID. The add-in also sends helper requests to the same endpoint. In every Office app, they summarize a long conversation, write the status line shown while Claude thinks, and, when memory is on, check an entry before Claude saves it. In Word and PowerPoint, they check how the document or a slide looks after Claude edits it, and in Word they also check Claude's reasoning before it edits legal language. In Outlook, they rewrite a passage the user selects in a draft, and learn the user's writing style from recent sent mail and from the user's edits to drafts. Each helper request carries a session ID made from the kind of helper request, the device identifier, and the date in UTC, so helper requests of one kind from one device on one day share a session ID. With a Claude account sign-in, requests also carry the user's account ID. In third-party platform deployments, requests carry no account ID and no email address. That includes deployments whose settings Anthropic serves, where members sign in with a Claude account. The short test requests that the add-in sends to check which models and features your endpoint supports, such as web search and code execution, carry none of these values |
257| Feature-flag requests | In every deployment, the add-in asks `claude.ai` which features to show. Each request includes the device identifier, the Office app, and, when the user is signed in to Office, the Entra ID tenant ID. With a Claude account sign-in, it also includes the user's email address, account ID, and organization ID. In every deployment, the add-in sends a usage event for each feature variant it showed. With a Claude account sign-in, the add-in also sends each variant it showed directly to Anthropic, with the organization ID |
258| Usage events | Sent to Anthropic's server at `pivot.claude.ai`, which forwards them to Anthropic's event logging service. Each event has a name and properties such as counts, durations, the model, and the Office app and its version, with the device identifier and an ID for the task pane session. With a Claude account sign-in, events also carry the account and organization IDs. Before sending an event, the add-in removes the fields known to carry file names, file paths, error text, and the names of your connectors and their tools. The filter matches field names, so it does not remove such text from a field it does not name. Events that load an Excel workbook or a PowerPoint presentation carry an unsalted hash of the file's path or address. With a Claude account sign-in, a user can rate a response and add a comment. The comment reaches Anthropic's server, which forwards the comment's length but not its text. When a user types a job role that is not on the list, the server forwards that the user chose Other, but not the text |
259| Identifiers from Office on usage events | When the user is signed in to Office, usage events also carry the Entra ID tenant ID, the domain of the user's email address, and the hash described in [What chat history is keyed to](#what-chat-history-is-keyed-to). The hash is unsalted, so anyone who knows the user's Entra ID object ID can match it |
260| Error reports sent to Sentry, with a Claude account sign-in | The user's account ID, the text of the error, the name of the tool that failed, and details about what failed, such as the name of a skill, a skill file, a memory entry, or a connector's host. The error text and these details can include conversation and document content. A report also lists the hosts the add-in contacted before the error |
261| Error reports sent to Sentry, in third-party platform deployments | Once the add-in has loaded the user's sign-in, each report holds only the type of error, where in the code it happened, the add-in's version, the Office app with its platform and version, the sign-in type, and the name of the built-in tool that failed. Reports sent before that point, such as those from the sign-in page, also include the error text and the hosts the add-in contacted |
262| Diagnostic traces, logs, and metrics sent to Anthropic | Counts, durations, error types, the model, request IDs, the names of built-in tools, and a session ID. With a Claude account sign-in, traces also carry the organization ID. Before sending traces and logs, the add-in removes every field that is not on an allowlist, so they exclude conversation text, document contents, file names, and the names of your connectors and their tools. Before sending metrics, the add-in removes a list of fields that includes file names and connector names |
263| Telemetry sent to a custom OpenTelemetry collector you configure | A collector set in the claude.ai admin console, in the manifest, in Entra ID claims, or by your bootstrap endpoint receives the full audit trail, including prompt content and tool inputs and outputs. That path skips the allowlist filter by design. A collector named in add-in settings that Anthropic serves from your Claude organization receives only the kinds of content those settings select, and no conversation or tool content if they select none. While a custom collector is set, traces and logs go only to that collector, and metrics still go to Anthropic. See [Audit and observability](/docs/office-agents/enterprise-readiness#audit-and-observability) |
264
265When Anthropic
266[serves your add-in settings from your Claude organization](/docs/office-agents/third-party-platforms#serve-add-in-settings-from-your-claude-organization),
267members sign in with a Claude account. This option is in preview. Feature-flag
268requests, usage events, and the session records that Sentry keeps, which count
269sessions and crashes, then carry the identifiers described for a Claude account
270sign-in. Error reports follow the row for third-party platform deployments.
271Files that these members attach are not uploaded to Anthropic. Your
272organization's setting that turns off third-party analytics does not apply to
273these members.
274
275Until September 23, 2026, Anthropic's server sent usage events to Segment, a
276third-party analytics service. These included the text of rating comments and
277any job role a user typed during onboarding or in a later survey.
278
279With a Claude account sign-in, the add-in stops sending usage events and error
280reports for an organization whose Claude settings turn off third-party
281analytics. Usage events go to Anthropic rather than to a third party, and the
282setting still stops them. The add-in applies the setting once it has loaded the
283organization's settings, so events from before that point, such as those during
284sign-in, can still be sent.
285
286The setting does not stop the following:
287
288* The session records that Sentry keeps. They can include the user's account
289 ID.
290* Feature-flag requests, and the feature variants the add-in sends directly to
291 Anthropic.
292* The identifiers on model requests.
293* The traces, logs, and metrics sent to Anthropic.
294
295In third-party platform deployments, including those whose settings Anthropic
296serves, no add-in setting stops usage events or error reports. You can block
297the Sentry host listed in the
298[network allowlist](/docs/office-agents/third-party-platforms#network-allowlist).
204299
205300## Export a user's data before a device is rebuilt
206301
office-agents/third-party-platforms Changed · +49 / -4 lines
### Route Vertex AI direct through your own gateway
from line 63
6363| - | - | - |
6464| `pivot.claude.ai` | Always | Add-in host serving task pane UI, analytics, icon search, skill downloads, and telemetry. |
6565| `claude.ai` | Always | Anthropic OAuth sign-in and feature-flag evaluation. |
66| `hcaptcha.com`, `*.hcaptcha.com` | Always | hCaptcha browser check on the `claude.ai` sign-in and approval pages, which open in the user's web browser. If these domains are blocked, the sign-in approval can fail with a message that the browser couldn't be verified. |
6667| `api.anthropic.com` | Always | Claude inference API, file uploads, code-execution containers, and MCP connector registry. |
6768| `appsforoffice.microsoft.com` | Always | Microsoft Office.js runtime script (required by all Office add-ins). |
6869| `login.microsoftonline.com` | If using Outlook | Microsoft Entra ID sign-in via Nested App Auth for the Graph token. |
from line 110
109110| `aiplatform.googleapis.com` | If using Vertex AI direct | Vertex AI global inference endpoint. |
110111| `<region>-aiplatform.googleapis.com` | If using Vertex AI direct | Vertex AI regional inference endpoint; replace `<region>` with your GCP region. |
111112| `<resource>.services.ai.azure.com` | If using Foundry direct | Azure AI Foundry inference endpoint; replace `<resource>` with your resource name. |
113| Your Vertex AI gateway URL | If using Vertex AI direct through your own gateway | The gateway or proxy set in `gcp_base_url`. Connections made while it is set do not call `aiplatform.googleapis.com` or `<region>-aiplatform.googleapis.com`. Google sign-in still uses `accounts.google.com` and `oauth2.googleapis.com`. |
112114| Your Foundry gateway URL | If using Foundry direct through your own gateway | The gateway or proxy set in `azure_base_url`. Connections made while it is set do not call `<resource>.services.ai.azure.com`. |
113115| `graph.microsoft.com` | If using Outlook | Microsoft Graph mailbox and calendar API. |
114116
from line 117
115117If Anthropic serves your add-in settings from your Claude organization,
116118as described in
117119[Serve add-in settings from your Claude organization](#serve-add-in-settings-from-your-claude-organization),
118also allow `claude.ai` and `api.anthropic.com`. Members sign in with
119their Claude account at `claude.ai`, and the add-in reads your
120organization's settings from `api.anthropic.com`. Inference still goes
121only to the gateway or cloud provider those settings name.
120also allow `claude.ai`, `api.anthropic.com`, `hcaptcha.com`, and
121`*.hcaptcha.com`. Members sign in with their Claude account at
122`claude.ai`, and the add-in reads your organization's settings from
123`api.anthropic.com`. The `claude.ai` sign-in and approval pages run an
124hCaptcha browser check. Inference still goes only to the gateway or cloud
125provider those settings name.
122126
123127## Deploy the add-in for your organization
124128
from line 271
267271| `addin.access` | Kill switch: the add-in refuses to run. |
268272| `file.upload` | Blocks attaching files to the conversation. |
269273| `web_search` | Removes the built-in web search and web fetch tools, whose queries are served by Anthropic's search provider, along with the user-facing web search toggle. Code execution is unaffected. |
274| `permission_mode.accept_all_edits` | Keeps users in "Ask before edits": "Accept all edits" and "Skip all permissions" can't be turned on, and users already in either mode go back to "Ask before edits". Connector "Always allow" choices are unaffected. |
275| `permission_mode.dangerously_always_allow` | Removes the "Dangerously always allow" button from approval cards. It switches users to the mode shown as "Skip all permissions"; users already in that mode are moved to "Accept all edits". |
270276
271277Unknown slugs are ignored, so setting a slug from a newer add-in version
272278on an older deployment is safe.
from line 648
642648| `azure_resource_name` | Your Foundry resource name. |
643649| `azure_base_url` | The gateway base URL, for example `https://ai-gateway.example.com/foundry/anthropic`. |
644650| `azure_api_key` | The key the gateway expects as `x-api-key`. Omit it with keyless sign-in. |
651
652### Route Vertex AI direct through your own gateway
653
654If your organization reaches Vertex AI through a gateway or proxy it
655operates, set `gcp_base_url` to that gateway's base URL, API version
656included. Each user still signs in with Google, and the add-in keeps the
657Vertex AI request format, but it sends every request to
658`<gcp_base_url>/projects/<project>/locations/<region>/publishers/anthropic/models/<model>:rawPredict`,
659or `:streamRawPredict` for streaming responses, instead of
660`https://<region>-aiplatform.googleapis.com/v1/...`, with the user's
661Google access token as `Authorization: Bearer`. Google sign-in and token
662refresh still go to `accounts.google.com` and `oauth2.googleapis.com`.
663`gcp_project_id`, `google_client_id`, and `google_client_secret` are
664still required, and `gcp_region` still names the region in the request
665path.
666
667Use the same value you would set as Claude Code's
668`ANTHROPIC_VERTEX_BASE_URL`. The URL must use HTTPS. Because the add-in
669calls the gateway from the browser, the gateway must meet the
670[CORS requirements](#cors-requirements), and your network must allow its
671domain as listed in the [network allowlist](#network-allowlist). On this
672path the add-in sends the same headers it sends to Vertex AI:
673`authorization`, `content-type`, `accept`, and `user-agent`. The token
674the gateway receives is the user's Google OAuth token with the
675`cloud-platform` scope, so the gateway should forward it to Vertex AI
676and not store it.
677
678Users who connected before you set `gcp_base_url` keep their direct
679connection until they log out and sign in again, as described in
680[Change or update your gateway connection](#change-or-update-your-gateway-connection).
681Until the setup wizard accepts this key, add `gcp_base_url` to the
682generated manifest URL by hand, or deliver it per user through Microsoft
683Entra ID extension attributes or a bootstrap endpoint.
684
685| Parameter | Value |
686| - | - |
687| `gcp_project_id` | Your Google Cloud project ID. |
688| `gcp_region` | The Vertex AI region, or `global`. |
689| `gcp_base_url` | The gateway base URL, for example `https://ai-gateway.example.com/vertex/v1`. |
645690
646691### Change or update your gateway connection
647692