One read of Claude Documentationclaude-docs-20261023T180724Z
267 pages moved out of 280 read.
Pages moved
267
significant first
Pages read
280
in this capture
Captured
18:07 UTC
Corpus hash
307a31a7094a
corpus-hash
What this read moved
26-50 of 267, page 2 of 11This capture is too large to show at once. Changes 26-50 of 267 are below, significant first; the rest are on the following screens.
claude-tag/admins/configure-github Changed · +11 / -11 lines
from line 8
88
99> [!TIP]
1010>
11> Using GitLab instead of GitHub? See [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab.md). GitLab uses a service-account token rather than an installed app.
11> Using GitLab instead of GitHub? See [Configure GitLab access](https://claude.com/docs/claude-tag/admins/configure-gitlab.md). GitLab uses a service-account token rather than an installed app.
1212
1313Claude Tag gives Claude its own GitHub identity, the Claude GitHub App, so pull requests it opens from a channel or a DM are authored by Claude rather than by a person. You only need GitHub access if a team will hand Claude code work: branches, pull requests, review, or CI follow-up.
1414
from line 40
4040
4141## Grant repository access
4242
43The remaining steps are in Claude Tag admin settings, not GitHub's settings. Granting repositories requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization. A [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can also add repositories to their own channel, limited to repositories their GitHub account is an admin of.
43The remaining steps are in Claude Tag admin settings, not GitHub's settings. Granting repositories requires the **Owner** role or the [**Claude Tag Admin** permission](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization. A [channel manager](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can also add repositories to their own channel, limited to repositories their GitHub account is an admin of.
4444
4545The GitHub page, a bundle's page, and a workspace's or channel's own page each offer the repositories the Claude GitHub App's installations reach, so you can grant a repository that no bundle holds yet. Pick repositories for each place on the GitHub page, or put them in a bundle to give a group of places the same set.
4646
from line 66
6666
6767### Grant repositories through a bundle
6868
69A [bundle](/docs/claude-tag/admins/add-connections.md#create-a-bundle)'s places decide which channels can use the repositories in it.
69A [bundle](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-bundle)'s places decide which channels can use the repositories in it.
7070
7171**1. Open a bundle**
7272
from line 84
8484
8585* The GitHub organization shows as **Connected** in the **GitHub** section at [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control).
8686* On the **Connectors** tab under **Claude's access**, select **GitHub**. Its page shows how many GitHub accounts the Claude GitHub App is installed on. Its **Access from** table lists each repository picked for a place and each repository a bundle holds. The **Set by** column reads **Here** for a repository picked for a place, or names the bundle that holds it, and **Used at** names where each one applies.
87* For the end-to-end check, open a draft PR from a test channel; see [Verify the bundle is live](/docs/claude-tag/admins/attach-to-scope.md#verify-the-bundle-is-live).
87* For the end-to-end check, open a draft PR from a test channel; see [Verify the bundle is live](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#verify-the-bundle-is-live).
8888
8989### If Claude can't reach a repository
9090
from line 112
112112
113113[Hooks](https://code.claude.com/docs/en/hooks) in a repository's `.claude/settings.json` don't run in the session. A repository's `.mcp.json` is never loaded.
114114
115Repository skills apply only in sessions that have the repository. To give a skill to every channel under a scope, add it through a [skills repository](/docs/claude-tag/admins/skills-repo.md).
115Repository skills apply only in sessions that have the repository. To give a skill to every channel under a scope, add it through a [skills repository](https://claude.com/docs/claude-tag/admins/skills-repo.md).
116116
117117### Install project dependencies
118118
119119Every session runs in an isolated sandbox with a standard set of preinstalled tools. There are two places to add what a project needs beyond that set, such as a specific language runtime or a database client:
120120
121* **For every session in a channel**, an admin adds the install commands to the setup script of the environment the channel's sessions run on. See [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
121* **For every session in a channel**, an admin adds the install commands to the setup script of the environment the channel's sessions run on. See [Configure the environment for a scope](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
122122* **For one repository**, add the install commands to the repository's `CLAUDE.md`.
123123
124124Claude follows `CLAUDE.md` as guidance when it starts work that needs it, not as an unconditional setup step. Write each install as a precondition of the work it supports, for example "install the SDK before building or running tests", so Claude runs it when a task touches that code. The sandbox is fresh for every session, so the installs repeat each time Claude works in the repository.
125125
126Prefer the standard package manager and its default registry over a vendor install script or a third-party package source. Package managers such as `apt`, `pip`, `npm`, and `dotnet` reach their default registries from the sandbox; downloads from other hosts can be blocked at the sandbox's [egress boundary](/docs/claude-tag/concepts/security-and-data.md#network-egress). An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) can allow an additional host with a domain entry on a bundle; see [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
126Prefer the standard package manager and its default registry over a vendor install script or a third-party package source. Package managers such as `apt`, `pip`, `npm`, and `dotnet` reach their default registries from the sandbox; downloads from other hosts can be blocked at the sandbox's [egress boundary](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress). An Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) can allow an additional host with a domain entry on a bundle; see [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
127127
128128## What Claude can do with GitHub Actions
129129
130In a channel, Claude acts on GitHub as the Claude GitHub App, and that identity carries a fixed set of GitHub Actions permissions. No admin setting changes it, and adding `api.github.com` as a [custom connector](/docs/claude-tag/admins/connections/custom.md) with your own token doesn't change it either; Claude's GitHub requests always act as the Claude GitHub App.
130In a channel, Claude acts on GitHub as the Claude GitHub App, and that identity carries a fixed set of GitHub Actions permissions. No admin setting changes it, and adding `api.github.com` as a [custom connector](https://claude.com/docs/claude-tag/admins/connections/custom.md) with your own token doesn't change it either; Claude's GitHub requests always act as the Claude GitHub App.
131131
132132Claude can:
133133
from line 175
175175
176176#### GitHub Enterprise Server in direct messages
177177
178In a [one-to-one direct message](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels), Claude reaches repositories on a registered host through the sender's own GitHub Enterprise account instead of the bundle's grants. Claude adds a repository to a DM session only when both of these are true:
178In a [one-to-one direct message](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels), Claude reaches repositories on a registered host through the sender's own GitHub Enterprise account instead of the bundle's grants. Claude adds a repository to a DM session only when both of these are true:
179179
180180* The sender's GitHub Enterprise account has push access to the repository
181181* Your GitHub App's installation on the instance includes the repository
from line 186
186186
187187## Related resources
188188
189* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope.md): add the bundle to the workspaces and channels that need it
190* [Set up routines](/docs/claude-tag/users/proactivity.md): the scheduled jobs that use this connection
189* [Configure per-channel access](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): add the bundle to the workspaces and channels that need it
190* [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md): the scheduled jobs that use this connection
191191
claude-tag/admins/configure-gitlab Changed · +9 / -9 lines
from line 8
88
99Connecting GitLab lets Claude read repository contents, manage issues, review and comment on merge requests, and check pipeline status from any channel where the GitLab connector applies, all through the GitLab API. Unlike GitHub, there is no Claude app to install in GitLab. Instead, you give Claude its own GitLab user and add that user's personal access token as a connector.
1010
11The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](/docs/claude-tag/admins/configure-github.md) instead.
11The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
1212
1313A dedicated service account keeps Claude's GitLab activity attributed to a single identity you control. You decide which groups and projects it can reach by granting that account membership the same way you would for a person, and you can revoke or rescope it at any time without touching anyone else's access.
1414
1515## Prerequisites
1616
17* The **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization, to add a connector.
17* The **Owner** role or the [**Claude Tag Admin** permission](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization, to add a connector.
1818* Permission in GitLab to create a user (or a [service account](https://docs.gitlab.com/user/profile/service_accounts/) on tiers that offer it) and to add that user to the groups or projects Claude should reach.
1919
2020## Create a dedicated GitLab account for Claude
from line 46
4646
4747## Add the token as a connector
4848
49The first GitLab token you add from the **Connectors** tab is on in every workspace and channel as soon as you save it. To add GitLab for only the channels a bundle covers, add it from the bundle's page under **What's in it** instead; see [Create a bundle](/docs/claude-tag/admins/add-connections.md#create-a-bundle). To add it for one workspace or channel, [connect it from that place's page](/docs/claude-tag/admins/add-connections.md#connect-a-service-for-one-workspace-or-channel).
49The first GitLab token you add from the **Connectors** tab is on in every workspace and channel as soon as you save it. To add GitLab for only the channels a bundle covers, add it from the bundle's page under **What's in it** instead; see [Create a bundle](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-bundle). To add it for one workspace or channel, [connect it from that place's page](https://claude.com/docs/claude-tag/admins/add-connections.md#connect-a-service-for-one-workspace-or-channel).
5050
5151**1. Open the Connectors tab**
5252
from line 58
5858
5959**3. Choose where GitLab applies**
6060
61If this is GitLab's first token, GitLab is now on in every workspace and channel. A later token starts off everywhere until you pick its places under **Assign access** on GitLab's page. To use GitLab in only some channels, [restrict it on GitLab's page](/docs/claude-tag/admins/add-connections.md#restrict-a-connector-to-some-channels).
61If this is GitLab's first token, GitLab is now on in every workspace and channel. A later token starts off everywhere until you pick its places under **Assign access** on GitLab's page. To use GitLab in only some channels, [restrict it on GitLab's page](https://claude.com/docs/claude-tag/admins/add-connections.md#restrict-a-connector-to-some-channels).
6262
6363**4. Add the GitLab plugin**
6464
65If your organization's plugin library includes a GitLab plugin, add it where GitLab applies so Claude knows how to call the GitLab API. See [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins). The connector works without the plugin, which adds ready-made workflows.
65If your organization's plugin library includes a GitLab plugin, add it where GitLab applies so Claude knows how to call the GitLab API. See [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins). The connector works without the plugin, which adds ready-made workflows.
6666
67The token is held by [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) and injected on every API request to your GitLab host. The model and the session sandbox never see it.
67The token is held by [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) and injected on every API request to your GitLab host. The model and the session sandbox never see it.
6868
6969## Self-managed GitLab
7070
from line 78
7878
7979## Related resources
8080
81* [Connect GitLab](/docs/claude-tag/admins/connections/gitlab.md): the credential field reference and how GitLab differs from GitHub
82* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full connector and bundle reference
83* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): the GitHub App path, which is different
81* [Connect GitLab](https://claude.com/docs/claude-tag/admins/connections/gitlab.md): the credential field reference and how GitLab differs from GitHub
82* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full connector and bundle reference
83* [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md): the GitHub App path, which is different
8484
claude-tag/admins/connections/amplitude Changed · +6 / -6 lines
from line 10
1010
1111You can connect with a project API key and secret key, which you can limit to read requests, or by signing in as an Amplitude user, which gives Claude Amplitude's MCP tools for creating and editing content as well as reading it.
1212
13For the API key route, pair the connector with a plugin that covers Amplitude so Claude knows how to call the REST API. Add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. A member's own Amplitude connector on claude.ai is separate from this connector and applies in one-to-one DMs. Claude can also [use that connector in a channel](/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
13For the API key route, pair the connector with a plugin that covers Amplitude so Claude knows how to call the REST API. Add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. A member's own Amplitude connector on claude.ai is separate from this connector and applies in one-to-one DMs. Claude can also [use that connector in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
1414
1515## Choose an API key or Amplitude sign-in
1616
from line 73
7373
7474Amplitude rate-limits these APIs per project, with a cap on concurrent requests and an hourly budget in which queries that span more days or segments cost more. Claude's queries draw on the same budget as your project's other API clients. If Claude reports that Amplitude returned a rate-limit error (HTTP 429), narrow the date range, drop a group-by, or ask again later. Amplitude's [Dashboard REST API documentation](https://amplitude.com/docs/apis/analytics/dashboard-rest) lists the current limits.
7575
76The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
76The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
7777
7878## Add the connector with Amplitude sign-in
7979
from line 91
9191
9292The **Sign in to Amplitude as Claude** option shows the MCP server the sign-in grants access to, `https://mcp.amplitude.com/mcp`, and the form sets the connector's allowed host to that server for you.
9393
94The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you sign in.
94The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you sign in.
9595
9696Click **Sign in with Amplitude** at the bottom of the form. A sign-in window opens. If your browser blocks pop-ups, allow them for claude.ai and click **Sign in with Amplitude** again. Sign in to Amplitude as the dedicated user and approve access. When the sign-in completes and the window closes, the connector is saved and Amplitude's connector page opens, with the new credential marked **New**.
9797
from line 109
109109
110110## Related resources
111111
112* [Answer data questions](/docs/claude-tag/users/use-cases/answer-data-questions.md): the question-to-chart pattern in a Slack thread, shown there with a data warehouse
113* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
114* [Connect a custom service](/docs/claude-tag/admins/connections/custom.md): for Amplitude APIs the **Amplitude** entry doesn't cover, such as the User Profile API, which lives on `profile-api.amplitude.com` and authenticates with a different header
112* [Answer data questions](https://claude.com/docs/claude-tag/users/use-cases/answer-data-questions.md): the question-to-chart pattern in a Slack thread, shown there with a data warehouse
113* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
114* [Connect a custom service](https://claude.com/docs/claude-tag/admins/connections/custom.md): for Amplitude APIs the **Amplitude** entry doesn't cover, such as the User Profile API, which lives on `profile-api.amplitude.com` and authenticates with a different header
115115* Amplitude's [API authentication](https://amplitude.com/docs/apis/authentication), [API key and secret key management](https://amplitude.com/docs/admin/account-management/manage-your-api-keys-and-secret-keys), and [Amplitude MCP](https://amplitude.com/docs/amplitude-ai/amplitude-mcp) documentation
116116
claude-tag/admins/connections/asana Changed · +4 / -4 lines
from line 25
2525| Claude's personal access token | The personal access token from Asana |
2626| Allowed websites | `app.asana.com` (preset) |
2727
28If the connect form offers to include the Asana plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
28If the connect form offers to include the Asana plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
2929
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3131
3232## Verify the connection
3333
from line 41
4141
4242## Related resources
4343
44* [What this connection adds](/docs/claude-tag/users/use-cases/track-projects.md): the issue tracking use cases
45* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
44* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/track-projects.md): the issue tracking use cases
45* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4646
claude-tag/admins/connections/atlassian Changed · +6 / -6 lines
from line 26
2626
2727Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Jira & Confluence**. Leave **Paste an API key** selected and click **Continue to Jira & Confluence**.
2828
29In the connect form, with **Use an API token** selected, enter the dedicated account's email address, the API token from Atlassian, and your own site's hostname, such as `your-domain.atlassian.net`. Claude sends the token only to that site. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
29In the connect form, with **Use an API token** selected, enter the dedicated account's email address, the API token from Atlassian, and your own site's hostname, such as `your-domain.atlassian.net`. Claude sends the token only to that site. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3030
31The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
31The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3232
3333> [!NOTE]
3434>
35> Atlassian Data Center (self-hosted) isn't covered by the **Jira & Confluence** entry because it authenticates with a personal access token sent as a Bearer header. Add a Data Center instance as a [custom connector](/docs/claude-tag/admins/connections/custom.md) with the **Bearer** credential type and your instance's hostname under **Allowed websites**. The instance must be reachable from the public internet.
35> Atlassian Data Center (self-hosted) isn't covered by the **Jira & Confluence** entry because it authenticates with a personal access token sent as a Bearer header. Add a Data Center instance as a [custom connector](https://claude.com/docs/claude-tag/admins/connections/custom.md) with the **Bearer** credential type and your instance's hostname under **Allowed websites**. The instance must be reachable from the public internet.
3636
3737## Connect a token with scopes through the Atlassian gateway
3838
from line 44
4444
4545**2. Add the gateway connector**
4646
47Under **What's in it**, click **Add**, select **Connector**, and select **Custom connector**. In the [custom connector](/docs/claude-tag/admins/connections/custom.md) form, enter a **Name**, choose the **Basic** credential type, enter the dedicated account's email as the **Username** and the API token as the **Password**, and enter `api.atlassian.com` under **Allowed websites**. Click **Connect** to save the connector.
47Under **What's in it**, click **Add**, select **Connector**, and select **Custom connector**. In the [custom connector](https://claude.com/docs/claude-tag/admins/connections/custom.md) form, enter a **Name**, choose the **Basic** credential type, enter the dedicated account's email as the **Username** and the API token as the **Password**, and enter `api.atlassian.com` under **Allowed websites**. Click **Connect** to save the connector.
4848
4949**3. Limit the credential to your site's paths**
5050
from line 68
6868
6969## Related resources
7070
71* [Custom connector](/docs/claude-tag/admins/connections/custom.md): for a setup the **Jira & Confluence** entry doesn't cover, such as a self-hosted Data Center instance
72* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full connection model and how to scope a dedicated account
71* [Custom connector](https://claude.com/docs/claude-tag/admins/connections/custom.md): for a setup the **Jira & Confluence** entry doesn't cover, such as a self-hosted Data Center instance
72* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full connection model and how to scope a dedicated account
7373
claude-tag/admins/connections/bigquery Changed · +6 / -6 lines
from line 25
2525
2626## Add the connector
2727
28Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **BigQuery**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. In the connect form, paste the whole JSON key file from Google Cloud Console into **Claude's service account key (JSON)**, then click **Connect** to save the connector.
28Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **BigQuery**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. In the connect form, paste the whole JSON key file from Google Cloud Console into **Claude's service account key (JSON)**, then click **Connect** to save the connector.
2929
3030The access tokens Claude gets from this key carry only Google's `cloud-platform.read-only` scope, so Google refuses BigQuery API calls that create or delete tables or run load jobs. Queries still run with whatever the service account's roles allow, so the [dataset roles](#grant-access-to-specific-datasets) decide what a query can reach.
3131
32Agent Proxy exchanges the service-account key for an access token and injects it at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
32Agent Proxy exchanges the service-account key for an access token and injects it at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3333
3434## Verify the connection
3535
from line 51
5151
5252If the Google Cloud project that holds your BigQuery data is inside a [VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/overview) perimeter, Claude's queries fail with `Request is prohibited by organization's policy` and a `vpcServiceControlsUniqueIdentifier` in the error details. To let them through, add an ingress rule that admits the [service account you created for Claude](#create-the-credential-in-google-cloud).
5353
54If you allowlist [Anthropic's published egress IP range](/docs/claude-tag/admins/network-requirements.md) in an access level, Claude's queries still fail, because they reach your perimeter from inside Google Cloud rather than from that range. The source your perimeter sees is a Google Cloud project that Anthropic owns and can change without notice, so don't admit that project by its number.
54If you allowlist [Anthropic's published egress IP range](https://claude.com/docs/claude-tag/admins/network-requirements.md) in an access level, Claude's queries still fail, because they reach your perimeter from inside Google Cloud rather than from that range. The source your perimeter sees is a Google Cloud project that Anthropic owns and can change without notice, so don't admit that project by its number.
5555
5656Add an [ingress rule](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules) to the perimeter with these settings:
5757
from line 65
6565
6666The ingress rule lets requests authenticated as the service account you created for Claude cross the perimeter, and only to reach BigQuery in the project the rule names. It doesn't give the service account access to any data. The [dataset roles you granted](#grant-access-to-specific-datasets) still decide which datasets Claude can read, so keep those grants narrow.
6767
68Once the connection works, delete the key file that Google Cloud downloaded to your machine when you created the key. With this rule in place, the perimeter doesn't stop a leaked key for this service account, because a request authenticated with any of the account's valid keys passes the rule from any source. [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) holds the key you uploaded and Claude never sees it. To limit that risk further, don't create more keys for the service account.
68Once the connection works, delete the key file that Google Cloud downloaded to your machine when you created the key. With this rule in place, the perimeter doesn't stop a leaked key for this service account, because a request authenticated with any of the account's valid keys passes the rule from any source. [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) holds the key you uploaded and Claude never sees it. To limit that risk further, don't create more keys for the service account.
6969
7070## Related resources
7171
72* [What this connection adds](/docs/claude-tag/users/use-cases/answer-data-questions.md): warehouse questions answered with charts in the thread
73* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
72* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/answer-data-questions.md): warehouse questions answered with charts in the thread
73* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
7474
claude-tag/admins/connections/custom Changed · +17 / -17 lines
from line 6
66>
77> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
9For a service that isn't in the **Add a connector** list, add a custom connector. This works for any service with an HTTP API. The [BigQuery](/docs/claude-tag/admins/connections/bigquery.md) guide is a worked example.
9For a service that isn't in the **Add a connector** list, add a custom connector. This works for any service with an HTTP API. The [BigQuery](https://claude.com/docs/claude-tag/admins/connections/bigquery.md) guide is a worked example.
1010
1111To open the form, go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab, click **Add**, and select **Custom connector** at the bottom of the list. A connector added there for a host that isn't on the **Connectors** tab yet is on in every workspace and channel once you save it. For a host already listed under **Custom hosts**, the new credential starts off everywhere until you choose where it applies. For narrower reach:
1212
13* **Some channels**: [restrict it on its page](/docs/claude-tag/admins/add-connections.md#restrict-a-connector-to-some-channels).
14* **One workspace or channel**: on that place's page, click **Add** under **Claude's access**, select **Connector**, select **Custom connector** under **Connect new** on the **Connectors** tab, and click **Continue**. See [Connect a service for one workspace or channel](/docs/claude-tag/admins/add-connections.md#connect-a-service-for-one-workspace-or-channel).
15* **The places a bundle applies**: add it to the [bundle](/docs/claude-tag/admins/add-connections.md#create-a-bundle). Open the bundle's page, and under **What's in it** click **Add**, choose **Connector**, and select **Custom connector**.
13* **Some channels**: [restrict it on its page](https://claude.com/docs/claude-tag/admins/add-connections.md#restrict-a-connector-to-some-channels).
14* **One workspace or channel**: on that place's page, click **Add** under **Claude's access**, select **Connector**, select **Custom connector** under **Connect new** on the **Connectors** tab, and click **Continue**. See [Connect a service for one workspace or channel](https://claude.com/docs/claude-tag/admins/add-connections.md#connect-a-service-for-one-workspace-or-channel).
15* **The places a bundle applies**: add it to the [bundle](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-bundle). Open the bundle's page, and under **What's in it** click **Add**, choose **Connector**, and select **Custom connector**.
1616
1717## Add a custom HTTP API
1818
from line 22
2222* The API host (for example `api.example.com`)
2323* How the API authenticates (which header or flow it expects)
2424
25See [Create a dedicated account per service](/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service) for the service-account patterns.
25See [Create a dedicated account per service](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service) for the service-account patterns.
2626
2727### Fill out the custom connector form
2828
from line 30
3030| :- | :- |
3131| **Name** | A label for this connector (for example "Internal billing API") |
3232| **Credential type** | Pick the type that matches how the API authenticates; see [Credential types](#credential-types) |
33| **Allowed websites** | The API's host (for example `api.example.com`). A wildcard is allowed as the leftmost label. You can't enter `*` alone here; a credential is always limited to specific hosts (see [Allow all hosts](/docs/claude-tag/admins/add-connections.md#allow-all-hosts)). The credential is sent only to hosts you list here. |
33| **Allowed websites** | The API's host (for example `api.example.com`). A wildcard is allowed as the leftmost label. You can't enter `*` alone here; a credential is always limited to specific hosts (see [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts)). The credential is sent only to hosts you list here. |
3434| **Path prefixes** (optional) | Restrict the credential to specific URL paths under the host. For the MCP Connector type, shown only when the provider you pick doesn't fix its own hosts and paths. |
3535| **Custom headers** | Any extra headers the API requires beyond the credential. Shown only for the Bearer credential type. |
3636
37After saving, where the credential has an allow rule, you can narrow it by HTTP method and path from its **Edit connection** dialog, opened from **Edit** in the credential's row menu on the connector's page; see [Restrict by path or method](/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method). To narrow a credential before any channel can use it, add the connector to a new [bundle](/docs/claude-tag/admins/add-connections.md#create-a-bundle), select **Edit** from the menu on its row under **What's in it**, and add the bundle's places last.
37After saving, where the credential has an allow rule, you can narrow it by HTTP method and path from its **Edit connection** dialog, opened from **Edit** in the credential's row menu on the connector's page; see [Restrict by path or method](https://claude.com/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method). To narrow a credential before any channel can use it, add the connector to a new [bundle](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-bundle), select **Edit** from the menu on its row under **What's in it**, and add the bundle's places last.
3838
3939### Credential types
4040
from line 48
4848| **GCP IAP (with Service Account Key)** | Google Cloud services behind Identity-Aware Proxy |
4949| **OAuth 2.0 JWT bearer** | APIs that accept a JWT signed with your private key in exchange for an access token (DocuSign, for example) |
5050| **OAuth 2.0 client credentials** | Machine-to-machine OAuth with a client ID and secret |
51| **MCP Connector** | OAuth sign-in to one of the providers in the picker or to a [remote MCP connector](/docs/connectors/custom/add-unlisted.md) your organization has added on claude.ai. Sign in once as an admin; the agent acts as that account. Other OAuth APIs can't be connected this way. |
51| **MCP Connector** | OAuth sign-in to one of the providers in the picker or to a [remote MCP connector](https://claude.com/docs/connectors/custom/add-unlisted.md) your organization has added on claude.ai. Sign in once as an admin; the agent acts as that account. Other OAuth APIs can't be connected this way. |
5252
5353> [!NOTE]
5454>
5555> The **MCP Connector** type signs in to a connector from your organization's connector library. If you register a new connector from this form with **Add custom connector…**, that connector is added to the library on the **Connectors** page at [`claude.ai/admin-settings/connectors`](https://claude.ai/admin-settings/connectors), not only to Claude Tag. Removing the Claude Tag connector later leaves the library entry in place.
5656
57For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github.md) rather than a credential from this table.
57For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md) rather than a credential from this table.
5858
5959If you're unsure which type, check the service's API authentication docs for which header or flow it expects.
6060
from line 80
8080
8181Use long-lived credentials from a dedicated IAM user where you can. Temporary STS credentials work but expire on their own schedule, and the connector stops working when they do; you re-enter all three values to rotate.
8282
83Claude can call the endpoint with `curl`, an AWS SDK, or the AWS CLI. The sandbox holds no real AWS credentials, so a CLI or SDK signs the request with placeholder values; Agent Proxy strips that signature and re-signs with the stored credential before the request leaves for AWS. If a request comes back with HTTP 502 and a reason that begins `injection failed ("<connection name>")`, Agent Proxy couldn't sign it. The troubleshooting entry [An AWS request fails after a successful sign-in](/docs/claude-tag/admins/federated-access/troubleshooting.md#an-aws-request-fails-after-a-successful-sign-in) lists each cause the reason text names and its fix; the causes and fixes are the same for a connector that stores an access key.
83Claude can call the endpoint with `curl`, an AWS SDK, or the AWS CLI. The sandbox holds no real AWS credentials, so a CLI or SDK signs the request with placeholder values; Agent Proxy strips that signature and re-signs with the stored credential before the request leaves for AWS. If a request comes back with HTTP 502 and a reason that begins `injection failed ("<connection name>")`, Agent Proxy couldn't sign it. The troubleshooting entry [An AWS request fails after a successful sign-in](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md#an-aws-request-fails-after-a-successful-sign-in) lists each cause the reason text names and its fix; the causes and fixes are the same for a connector that stores an access key.
8484
8585#### When AWS returns `SignatureDoesNotMatch`
8686
from line 95
9595
9696### OAuth 2.0 JWT bearer
9797
98Use the **OAuth 2.0 JWT bearer** credential type for APIs that exchange a JWT signed with your private key for an access token. The [Salesforce guide](/docs/claude-tag/admins/connections/salesforce.md) is a worked example.
98Use the **OAuth 2.0 JWT bearer** credential type for APIs that exchange a JWT signed with your private key for an access token. The [Salesforce guide](https://claude.com/docs/claude-tag/admins/connections/salesforce.md) is a worked example.
9999
100100The **Private key (PEM)** field takes a PEM-encoded RSA private key without a passphrase, the format that begins with `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`. Identity providers such as Okta export the key as a JWK (a JSON object) by default; convert a JWK to PEM before pasting it. The form doesn't check the key's format, so a key in the wrong format fails only when you save.
101101
from line 107
107107
108108## Add a custom MCP server
109109
110The server must be a remote endpoint that Claude can reach at a URL over the internet. An MCP server that runs on a person's machine over stdio, including one packaged as a [desktop extension](/docs/connectors/custom/add-unlisted.md#install-a-local-connector-in-the-desktop-app), can't be connected, because [sessions](/docs/claude-tag/concepts/glossary.md#session) run in a cloud sandbox that Anthropic hosts, not on anyone's machine. Host the server as a remote endpoint first, then follow the steps below.
110The server must be a remote endpoint that Claude can reach at a URL over the internet. An MCP server that runs on a person's machine over stdio, including one packaged as a [desktop extension](https://claude.com/docs/connectors/custom/add-unlisted.md#install-a-local-connector-in-the-desktop-app), can't be connected, because [sessions](https://claude.com/docs/claude-tag/concepts/glossary.md#session) run in a cloud sandbox that Anthropic hosts, not on anyone's machine. Host the server as a remote endpoint first, then follow the steps below.
111111
112112To give Claude an MCP server (one you run, or a vendor's hosted MCP endpoint), the pattern is a plugin plus a credential:
113113
114114**1. Add a plugin that declares the MCP server**
115115
116Add a plugin whose `.mcp.json` points at the server URL, from your organization's library or your [skills repository](/docs/claude-tag/admins/skills-repo.md), wherever the server should be available; see [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins). The plugin tells Claude the server exists and how to call it.
116Add a plugin whose `.mcp.json` points at the server URL, from your organization's library or your [skills repository](https://claude.com/docs/claude-tag/admins/skills-repo.md), wherever the server should be available; see [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins). The plugin tells Claude the server exists and how to call it.
117117
118118**2. Add a credential for the server's host**
119119
from line 131
131131
132132Check the service's own audit log to confirm the call landed under your service account. New threads pick up the connector on their own.
133133
134If Claude reports that it can't use the credential, open the connector from the **Connectors** tab, where custom connectors are listed under **Custom hosts**. In its **Access from** table, **Not enabled** means no allow rule sends the credential yet; click **Enable** and confirm. A credential a teammate submitted through a setup link waits on the **Requests** tab of [**Notifications**](https://claude.ai/admin-settings/notifications) as **Approval needed**; click **Review**, then **Approve**. See [Verify the connector saved](/docs/claude-tag/admins/add-connections.md#verify-the-connector-saved).
134If Claude reports that it can't use the credential, open the connector from the **Connectors** tab, where custom connectors are listed under **Custom hosts**. In its **Access from** table, **Not enabled** means no allow rule sends the credential yet; click **Enable** and confirm. A credential a teammate submitted through a setup link waits on the **Requests** tab of [**Notifications**](https://claude.ai/admin-settings/notifications) as **Approval needed**; click **Review**, then **Approve**. See [Verify the connector saved](https://claude.com/docs/claude-tag/admins/add-connections.md#verify-the-connector-saved).
135135
136136## Related resources
137137
138* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full connector model
139* [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential): for public APIs that need no auth
140* [Allow all hosts](/docs/claude-tag/admins/add-connections.md#allow-all-hosts): the egress option that lets Claude reach any public host without a credential
138* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full connector model
139* [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential): for public APIs that need no auth
140* [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts): the egress option that lets Claude reach any public host without a credential
141141
claude-tag/admins/connections/datadog Changed · +5 / -5 lines
from line 38
3838| Claude's application key | The Application key from Datadog. Optional in the form; add it so Claude can read metrics, monitors, and dashboards |
3939| Allowed websites | The entry's API host (preset) |
4040
41If the connect form offers to include the Datadog plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
41If the connect form offers to include the Datadog plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
4242
43The connector is created with path prefixes that cover Datadog's read and query routes: metric, log, trace, and RUM queries, monitors, downtimes, dashboards, SLOs, notebooks, events, hosts, service definitions, and incident search. It doesn't cover Datadog's key, user, integration, or log-configuration management routes, so Claude can't call those through it. To narrow the connector further, for example to `GET` only, or to allow another route, go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click your Datadog connector, open the menu on the credential's row in the **Access from** table, and click **Edit**. See [Restrict by path or method](/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method).
43The connector is created with path prefixes that cover Datadog's read and query routes: metric, log, trace, and RUM queries, monitors, downtimes, dashboards, SLOs, notebooks, events, hosts, service definitions, and incident search. It doesn't cover Datadog's key, user, integration, or log-configuration management routes, so Claude can't call those through it. To narrow the connector further, for example to `GET` only, or to allow another route, go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click your Datadog connector, open the menu on the credential's row in the **Access from** table, and click **Edit**. See [Restrict by path or method](https://claude.com/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method).
4444
45The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
45The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
4646
4747## Verify the connection
4848
from line 56
5656
5757## Related resources
5858
59* [What this connection adds](/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
60* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
59* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
60* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
6161
claude-tag/admins/connections/gitlab Changed · +10 / -10 lines
from line 10
1010
1111> [!TIP]
1212>
13> This page is the credential field reference. The full setup walkthrough, including creating a dedicated GitLab service account for Claude and scoping its group access, is at [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab.md).
13> This page is the credential field reference. The full setup walkthrough, including creating a dedicated GitLab service account for Claude and scoping its group access, is at [Configure GitLab access](https://claude.com/docs/claude-tag/admins/configure-gitlab.md).
1414
1515If your plugin marketplace includes a GitLab plugin, pair it with this connector so Claude knows how to call the API. Add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The connector works without it.
1616
from line 18
1818
1919**1. Create the token in GitLab**
2020
21A personal access token from a [dedicated service account](/docs/claude-tag/admins/configure-gitlab.md#create-a-dedicated-gitlab-account-for-claude) is recommended, so one identity covers every group you add it to. Project and group access tokens also work if you only need a single project or group. Grant the `api` scope for read and write, or `read_api` for read-only. The token starts with `glpat-`.
21A personal access token from a [dedicated service account](https://claude.com/docs/claude-tag/admins/configure-gitlab.md#create-a-dedicated-gitlab-account-for-claude) is recommended, so one identity covers every group you add it to. Project and group access tokens also work if you only need a single project or group. Grant the `api` scope for read and write, or `read_api` for read-only. The token starts with `glpat-`.
2222
2323**2. Add the connector**
2424
25Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, select **GitLab**, and paste the token. For self-managed GitLab, switch to the form's **Advanced** tab and add your instance's hostname under **Allowed websites**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
25Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, select **GitLab**, and paste the token. For self-managed GitLab, switch to the form's **Advanced** tab and add your instance's hostname under **Allowed websites**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
2626
2727**You'll see:** GitLab on the **Connectors** tab, and `@Claude what can you access from this channel?` returns it in a new thread in any channel where the connector is on. New threads pick up the connector on their own; in an existing thread, ask Claude to use the service by name.
2828
from line 37
3737
3838| | GitLab | GitHub |
3939| :- | :- | :- |
40| Auth | A service account's personal access token | The Claude GitHub App, [installed separately](/docs/claude-tag/admins/configure-github.md) |
40| Auth | A service account's personal access token | The Claude GitHub App, [installed separately](https://claude.com/docs/claude-tag/admins/configure-github.md) |
4141| Referencing a project in a thread | Give Claude the full project URL; it reads it through the API | Typing `owner/repo` in the message auto-attaches it |
42| Self-managed | Your hostname under **Advanced > Allowed websites** | [GitHub Enterprise setup](/docs/claude-tag/admins/configure-github.md#github-enterprise) |
43| Handing back changes | Manages issues and comments on merge requests through the API | [Draft pull requests](/docs/claude-tag/users/use-cases/work-with-github.md) authored by the Claude GitHub App |
42| Self-managed | Your hostname under **Advanced > Allowed websites** | [GitHub Enterprise setup](https://claude.com/docs/claude-tag/admins/configure-github.md#github-enterprise) |
43| Handing back changes | Manages issues and comments on merge requests through the API | [Draft pull requests](https://claude.com/docs/claude-tag/users/use-cases/work-with-github.md) authored by the Claude GitHub App |
4444
45The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](/docs/claude-tag/admins/configure-github.md) instead.
45The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
4646
47The token is auto-injected on every API request to your GitLab host. The model and the sandbox are not given the key; see [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
47The token is auto-injected on every API request to your GitLab host. The model and the sandbox are not given the key; see [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
4848
4949## Related resources
5050
51* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): the GitHub App path, which is different
52* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
51* [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md): the GitHub App path, which is different
52* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
5353
claude-tag/admins/connections/gong Changed · +4 / -4 lines
from line 30
3030
3131Gong assigns each company its own API base URL, like `us-46459.api.gong.io`. Copy yours from **Company Settings > Ecosystem > API** in Gong, then switch to the connect form's **Advanced** tab and enter it under **Allowed websites**.
3232
33The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
33The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3434
35The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
35The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3636
3737## Verify the connection
3838
from line 46
4646
4747## Related resources
4848
49* [What this connection adds](/docs/claude-tag/users/use-cases/pull-deal-state.md): the go-to-market use cases
50* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
49* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/pull-deal-state.md): the go-to-market use cases
50* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
5151
claude-tag/admins/connections/google Changed · +6 / -6 lines
from line 8
88
99Connecting Google Drive, Calendar, and Gmail lets Claude read documents, spreadsheets, calendar events, and email in any channel where the connector is on. Claude connects with its own credential, not a person's.
1010
11This connector calls Google's HTTP APIs, and it's separate from members' personal claude.ai connectors. A member's own Google connector applies in one-to-one DMs. Claude can also [use it in a channel](/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
11This connector calls Google's HTTP APIs, and it's separate from members' personal claude.ai connectors. A member's own Google connector applies in one-to-one DMs. Claude can also [use it in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
1212
1313## Choose OAuth or a service account
1414
from line 27
2727>
2828> Use a dedicated Google account for this connector (for example, `[email protected]`), not your own. The connector is shared: anyone in a channel where it's on can ask Claude to read whatever this account can see in Drive, Calendar, and Gmail. A dedicated account starts with no access until you share the specific folders and calendars Claude needs, and keeps its activity under a separate identity in Google's audit log.
2929
30Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Google Drive**, **Google Calendar**, or **Gmail**. The connect form lists the Google hosts the connector can reach; there are no scopes to choose. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you sign in. Click **Sign in with Google Drive** (or **Sign in with Google Calendar**, or **Sign in with Gmail**), approve the Google consent screen, and the credential is saved.
30Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Google Drive**, **Google Calendar**, or **Gmail**. The connect form lists the Google hosts the connector can reach; there are no scopes to choose. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you sign in. Click **Sign in with Google Drive** (or **Sign in with Google Calendar**, or **Sign in with Gmail**), approve the Google consent screen, and the credential is saved.
3131
3232The connector's reach is whatever the signed-in Google account can see. Share the relevant folders and calendars with that account in Google before testing.
3333
from line 44
4444| Subject (optional) | A user email to impersonate via domain-wide delegation. Set this for Workspace data (Drive, Calendar, Gmail, Docs). |
4545| Allowed websites | `*.googleapis.com` |
4646
47The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
47The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
4848
4949For Google Workspace data (Drive, Calendar, Gmail, Docs), the service account needs domain-wide delegation configured in your Google Admin console. In the service account's domain-wide delegation entry, list every scope you entered in **Scopes**, or `https://www.googleapis.com/auth/cloud-platform` if you left **Scopes** empty. Google's guide is at [developers.google.com/identity/protocols/oauth2/service-account](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority).
5050
5151Google refuses the token request when the domain-wide delegation entry is missing one of the requested scopes. Claude then reports HTTP 502 with a reason that starts with `injection failed ("<connection name>")`.
5252
53The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
53The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
5454
5555## Verify the connection
5656
from line 66
6666
6767## Related resources
6868
69* [What this connection adds](/docs/claude-tag/users/use-cases/find-answers.md): grounding answers in your team's documents
70* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
69* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/find-answers.md): grounding answers in your team's documents
70* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
7171
claude-tag/admins/connections/hubspot Changed · +4 / -4 lines
from line 25
2525| Claude's private app token | The private app token from HubSpot |
2626| Allowed websites | `api.hubapi.com` (preset) |
2727
28If the connect form offers to include the HubSpot plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
28If the connect form offers to include the HubSpot plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
2929
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3131
3232## Verify the connection
3333
from line 41
4141
4242## Related resources
4343
44* [What this connection adds](/docs/claude-tag/users/use-cases/pull-deal-state.md): the go-to-market use cases
45* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
44* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/pull-deal-state.md): the go-to-market use cases
45* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4646
claude-tag/admins/connections/linear Changed · +4 / -4 lines
from line 27
2727| Claude's API key | The API key from Linear |
2828| Allowed websites | `api.linear.app` (preset) |
2929
30If the connect form offers to include the Linear plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
30If the connect form offers to include the Linear plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3131
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3333
3434## Verify the connection
3535
from line 43
4343
4444## Related resources
4545
46* [What this connection adds](/docs/claude-tag/users/use-cases/create-artifacts.md): the issue tracking use cases
47* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
46* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/create-artifacts.md): the issue tracking use cases
47* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4848
claude-tag/admins/connections/notion Changed · +4 / -4 lines
from line 25
2525| Claude's integration secret | The internal integration secret from Notion |
2626| Allowed websites | `api.notion.com` (preset) |
2727
28If the connect form offers to include the Notion plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
28If the connect form offers to include the Notion plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
2929
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3131
3232## Verify the connection
3333
from line 41
4141
4242## Related resources
4343
44* [What this connection adds](/docs/claude-tag/users/use-cases/find-answers.md): the knowledge and docs use cases
45* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
44* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/find-answers.md): the knowledge and docs use cases
45* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4646
claude-tag/admins/connections/overview Changed · +24 / -24 lines
from line 6
66>
77> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
9Each guide covers one service: how to create the credential as a dedicated identity, what to paste into the connect form, and the **Allowed websites** value. For the model behind connectors (credential types, Agent Proxy, allowed websites, bundles), see [Give Claude access](/docs/claude-tag/admins/add-connections.md).
9Each guide covers one service: how to create the credential as a dedicated identity, what to paste into the connect form, and the **Allowed websites** value. For the model behind connectors (credential types, Agent Proxy, allowed websites, bundles), see [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md).
1010
1111> [!WARNING]
1212>
13> Always connect a dedicated account for Claude (for example, `[email protected]`), not your personal login. Anyone in a channel where the connector applies can use it through Claude, so whatever this account can reach is available to every member of those channels. See [Create a dedicated account per service](/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service). Before you add a connector, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#where-a-new-connector-applies).
13> Always connect a dedicated account for Claude (for example, `[email protected]`), not your personal login. Anyone in a channel where the connector applies can use it through Claude, so whatever this account can reach is available to every member of those channels. See [Create a dedicated account per service](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service). Before you add a connector, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#where-a-new-connector-applies).
1414
1515| Service | Category | Guide |
1616| :- | :- | :- |
17| Datadog | Monitoring | [Connect Datadog](/docs/claude-tag/admins/connections/datadog.md) |
18| Sentry | Monitoring | [Connect Sentry](/docs/claude-tag/admins/connections/sentry.md) |
19| PagerDuty | Monitoring | [Connect PagerDuty](/docs/claude-tag/admins/connections/pagerduty.md) |
20| Linear | Issue tracking | [Connect Linear](/docs/claude-tag/admins/connections/linear.md) |
21| Asana | Issue tracking | [Connect Asana](/docs/claude-tag/admins/connections/asana.md) |
22| Jira and Confluence | Issue tracking | [Connect Jira and Confluence](/docs/claude-tag/admins/connections/atlassian.md) |
23| Notion | Knowledge and docs | [Connect Notion](/docs/claude-tag/admins/connections/notion.md) |
24| Google (Drive, Calendar, Gmail) | Knowledge and docs | [Connect Google](/docs/claude-tag/admins/connections/google.md) |
25| HubSpot | Go-to-market | [Connect HubSpot](/docs/claude-tag/admins/connections/hubspot.md) |
26| Salesforce | Go-to-market | [Connect Salesforce](/docs/claude-tag/admins/connections/salesforce.md) |
27| Gong | Go-to-market | [Connect Gong](/docs/claude-tag/admins/connections/gong.md) |
28| GitLab | Code | [Connect GitLab](/docs/claude-tag/admins/connections/gitlab.md) |
29| BigQuery (custom) | Data warehouse | [Connect BigQuery](/docs/claude-tag/admins/connections/bigquery.md) |
30| Snowflake | Data warehouse | [Connect Snowflake](/docs/claude-tag/admins/connections/snowflake.md) |
31| Amplitude | Product analytics | [Connect Amplitude](/docs/claude-tag/admins/connections/amplitude.md) |
32| Stripe | Billing | [Connect Stripe](/docs/claude-tag/admins/connections/stripe.md) |
33| Vercel | Deployments | [Connect Vercel](/docs/claude-tag/admins/connections/vercel.md) |
17| Datadog | Monitoring | [Connect Datadog](https://claude.com/docs/claude-tag/admins/connections/datadog.md) |
18| Sentry | Monitoring | [Connect Sentry](https://claude.com/docs/claude-tag/admins/connections/sentry.md) |
19| PagerDuty | Monitoring | [Connect PagerDuty](https://claude.com/docs/claude-tag/admins/connections/pagerduty.md) |
20| Linear | Issue tracking | [Connect Linear](https://claude.com/docs/claude-tag/admins/connections/linear.md) |
21| Asana | Issue tracking | [Connect Asana](https://claude.com/docs/claude-tag/admins/connections/asana.md) |
22| Jira and Confluence | Issue tracking | [Connect Jira and Confluence](https://claude.com/docs/claude-tag/admins/connections/atlassian.md) |
23| Notion | Knowledge and docs | [Connect Notion](https://claude.com/docs/claude-tag/admins/connections/notion.md) |
24| Google (Drive, Calendar, Gmail) | Knowledge and docs | [Connect Google](https://claude.com/docs/claude-tag/admins/connections/google.md) |
25| HubSpot | Go-to-market | [Connect HubSpot](https://claude.com/docs/claude-tag/admins/connections/hubspot.md) |
26| Salesforce | Go-to-market | [Connect Salesforce](https://claude.com/docs/claude-tag/admins/connections/salesforce.md) |
27| Gong | Go-to-market | [Connect Gong](https://claude.com/docs/claude-tag/admins/connections/gong.md) |
28| GitLab | Code | [Connect GitLab](https://claude.com/docs/claude-tag/admins/connections/gitlab.md) |
29| BigQuery (custom) | Data warehouse | [Connect BigQuery](https://claude.com/docs/claude-tag/admins/connections/bigquery.md) |
30| Snowflake | Data warehouse | [Connect Snowflake](https://claude.com/docs/claude-tag/admins/connections/snowflake.md) |
31| Amplitude | Product analytics | [Connect Amplitude](https://claude.com/docs/claude-tag/admins/connections/amplitude.md) |
32| Stripe | Billing | [Connect Stripe](https://claude.com/docs/claude-tag/admins/connections/stripe.md) |
33| Vercel | Deployments | [Connect Vercel](https://claude.com/docs/claude-tag/admins/connections/vercel.md) |
3434
35GitHub is managed through the Claude GitHub App rather than a credential; see [Configure GitHub access](/docs/claude-tag/admins/configure-github.md).
35GitHub is managed through the Claude GitHub App rather than a credential; see [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md).
3636
3737Services marked (custom) aren't in the **Add a connector** list. Add them with **Custom connector** following their guide.
3838
3939## Connect a service that has no guide
4040
41You can add any app that has an API as a custom connector or a custom MCP server, including services this page has no guide for. See [Connect a custom service](/docs/claude-tag/admins/connections/custom.md) for the credential types and form fields.
41You can add any app that has an API as a custom connector or a custom MCP server, including services this page has no guide for. See [Connect a custom service](https://claude.com/docs/claude-tag/admins/connections/custom.md) for the credential types and form fields.
4242
4343## When a connector fails after setup
4444
45If Claude says it can't reach a service you connected, start with the checks at the top of [Troubleshoot Claude Tag setup](/docs/claude-tag/admins/troubleshooting.md). Open the channel's page from the **Channels** tab under **Claude's access** and confirm the connector is listed in its **Claude's access** table. Then rerun the test in a new thread.
45If Claude says it can't reach a service you connected, start with the checks at the top of [Troubleshoot Claude Tag setup](https://claude.com/docs/claude-tag/admins/troubleshooting.md). Open the channel's page from the **Channels** tab under **Claude's access** and confirm the connector is listed in its **Claude's access** table. Then rerun the test in a new thread.
4646
4747Two entries on the troubleshooting page cover connector failures directly:
4848
49* [A connection works in one channel but not another](/docs/claude-tag/admins/troubleshooting.md#a-connection-works-in-one-channel-but-not-another): the connector, or the bundle that holds it, likely doesn't apply to the failing channel
50* [I hit an authentication error and couldn't finish this turn](/docs/claude-tag/admins/troubleshooting.md#i-hit-an-authentication-error-and-couldn%E2%80%99t-finish-this-turn): Claude posts that message when its own request fails an authentication check. A connected service's failing credential surfaces as a tool error inside Claude's reply instead
49* [A connection works in one channel but not another](https://claude.com/docs/claude-tag/admins/troubleshooting.md#a-connection-works-in-one-channel-but-not-another): the connector, or the bundle that holds it, likely doesn't apply to the failing channel
50* [I hit an authentication error and couldn't finish this turn](https://claude.com/docs/claude-tag/admins/troubleshooting.md#i-hit-an-authentication-error-and-couldn%E2%80%99t-finish-this-turn): Claude posts that message when its own request fails an authentication check. A connected service's failing credential surfaces as a tool error inside Claude's reply instead
5151
claude-tag/admins/connections/pagerduty Changed · +5 / -5 lines
from line 12
1212
1313## Create the credential in PagerDuty
1414
15Generate a general-access read-only API key. A read-write key lets Claude acknowledge and resolve incidents. If you use one, [turn the connector on only in a private incident channel](/docs/claude-tag/admins/add-connections.md#add-a-connection).
15Generate a general-access read-only API key. A read-write key lets Claude acknowledge and resolve incidents. If you use one, [turn the connector on only in a private incident channel](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection).
1616
1717Creating a general-access key requires the PagerDuty Admin or Account Owner role; non-admins only see User Token keys, which also work but inherit that user's permissions.
1818
from line 29
2929
3030PagerDuty accounts on the EU service region use `api.eu.pagerduty.com` instead.
3131
32If the connect form offers to include the PagerDuty plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
32If the connect form offers to include the PagerDuty plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3333
34The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
34The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3535
3636## Verify the connection
3737
from line 45
4545
4646## Related resources
4747
48* [What this connection adds](/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
49* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
48* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
49* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
5050
claude-tag/admins/connections/salesforce Changed · +3 / -3 lines
from line 32
3232| Scopes (optional) | On the **Advanced** tab. Leave empty unless your app requires specific scopes |
3333| Allowed websites | Your org's host, for example `yourcompany.my.salesforce.com` |
3434
35The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. The **Allowed websites** field shows an example host that can't resolve. Enter your org's host there, then click **Connect** to save the connector.
35The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. The **Allowed websites** field shows an example host that can't resolve. Enter your org's host there, then click **Connect** to save the connector.
3636
3737To change the host later, go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Salesforce**, open the menu on the credential's row in the **Access from** table, and click **Edit**. In the **Edit connection** dialog, the **Allowed websites** setting is labeled **Allowed hosts**. Change the host there and click **Save**.
3838
39The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
39The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
4040
4141## Verify the connection
4242
from line 50
5050
5151## Related resources
5252
53* [Pull deal and account state](/docs/claude-tag/users/use-cases/pull-deal-state.md): what this connection adds
53* [Pull deal and account state](https://claude.com/docs/claude-tag/users/use-cases/pull-deal-state.md): what this connection adds
5454
claude-tag/admins/connections/sentry Changed · +4 / -4 lines
from line 29
2929
3030Self-hosted Sentry uses your own hostname instead of `sentry.io`.
3131
32If the connect form offers to include the Sentry plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
32If the connect form offers to include the Sentry plugin, leave that box selected; otherwise add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3333
34The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
34The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3535
3636## Verify the connection
3737
from line 45
4545
4646## Related resources
4747
48* [What this connection adds](/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
49* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
48* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md): the monitoring use cases
49* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
5050
claude-tag/admins/connections/snowflake Changed · +4 / -4 lines
from line 25
2525| Claude's programmatic access token | The programmatic access token from Snowflake |
2626| Allowed websites | Your account's host, for example `yourorg-youraccount.snowflakecomputing.com` |
2727
28The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. The **Allowed websites** field shows `*.snowflakecomputing.com` only as a hint, and a wildcard under `snowflakecomputing.com` can't be saved. Enter your account's host there, then click **Connect** to save the connector.
28The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. The **Allowed websites** field shows `*.snowflakecomputing.com` only as a hint, and a wildcard under `snowflakecomputing.com` can't be saved. Enter your account's host there, then click **Connect** to save the connector.
2929
3030To change the host later, go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Snowflake**, open the menu on the credential's row in the **Access from** table, and click **Edit**. In the **Edit connection** dialog, the **Allowed websites** setting is labeled **Allowed hosts**. Change the host there and click **Save**.
3131
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3333
3434## Verify the connection
3535
from line 43
4343
4444## Related resources
4545
46* [What this connection adds](/docs/claude-tag/users/use-cases/answer-data-questions.md): warehouse questions answered with charts in the thread
47* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
46* [What this connection adds](https://claude.com/docs/claude-tag/users/use-cases/answer-data-questions.md): warehouse questions answered with charts in the thread
47* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4848
claude-tag/admins/connections/stripe Changed · +3 / -3 lines
from line 27
2727
2828The field labeled Claude's secret key accepts a restricted key; the label is the field name, not a key-type constraint.
2929
30The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
30The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
3131
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
32The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3333
3434## Verify the connection
3535
from line 43
4343
4444## Related resources
4545
46* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
46* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4747
claude-tag/admins/connections/vercel Changed · +3 / -3 lines
from line 25
2525| Claude's access token | The access token from Vercel |
2626| Allowed websites | `api.vercel.com` (preset) |
2727
28The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
28The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector. Click **Connect** to save the connector.
2929
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
30The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
3131
3232## Verify the connection
3333
from line 41
4141
4242## Related resources
4343
44* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
44* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the full credential-type and allowed-hosts reference
4545
claude-tag/admins/customize Changed · +39 / -39 lines
from line 10
1010
1111| Layer | What it is | Who sets it | Where |
1212| :- | :- | :- | :- |
13| **Connectors** | The systems Claude can reach and the credentials it uses for each (GitHub, Drive, Datadog, your APIs) | Owner or [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); a [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for their assigned channels | The **Connectors** tab and [bundles](/docs/claude-tag/admins/add-connections.md) under **Claude's access**, or the channel's Configure page for a channel manager |
14| **Plugins and skills** | Instructions that teach Claude how to use a tool or follow a process. A plugin bundles one or more [skills](https://code.claude.com/docs/en/skills). | Owner or [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); channel members can add plugins to their channel unless an admin restricts editing | The **Skills and plugins** tab under **Claude's access**, a [bundle](/docs/claude-tag/admins/add-connections.md#attach-plugins), a [skills repository](/docs/claude-tag/admins/skills-repo.md), or the channel's Configure page |
15| **Custom instructions** | Standing guidance read in every session at a scope (team conventions, output formats). Outranks channel memory. | Owner for any scope; [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) for workspace and channel scopes; channel members for the channel scope, from the [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel) | [Per-scope instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) |
16| **Channel memory** | Facts Claude saves while working in a channel | Anyone in the channel | By [telling Claude](/docs/claude-tag/users/memory.md) |
13| **Connectors** | The systems Claude can reach and the credentials it uses for each (GitHub, Drive, Datadog, your APIs) | Owner or [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); a [channel manager](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for their assigned channels | The **Connectors** tab and [bundles](https://claude.com/docs/claude-tag/admins/add-connections.md) under **Claude's access**, or the channel's Configure page for a channel manager |
14| **Plugins and skills** | Instructions that teach Claude how to use a tool or follow a process. A plugin bundles one or more [skills](https://code.claude.com/docs/en/skills). | Owner or [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); channel members can add plugins to their channel unless an admin restricts editing | The **Skills and plugins** tab under **Claude's access**, a [bundle](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins), a [skills repository](https://claude.com/docs/claude-tag/admins/skills-repo.md), or the channel's Configure page |
15| **Custom instructions** | Standing guidance read in every session at a scope (team conventions, output formats). Outranks channel memory. | Owner for any scope; [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) for workspace and channel scopes; channel members for the channel scope, from the [Configure page](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel) | [Per-scope instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) |
16| **Channel memory** | Facts Claude saves while working in a channel | Anyone in the channel | By [telling Claude](https://claude.com/docs/claude-tag/users/memory.md) |
1717
1818Connectors and plugins decide what Claude *can do*; instructions and memory shape *how it does it*.
1919
2020## Settings admins control
2121
22Access and organization-wide behavior are set at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), per scope (a scope is a channel, a workspace, or your whole organization), so the same agent can work differently in different channels. Each scope has its own page on the **Channels** tab under **Claude's access**, and the **Slack** page there covers your whole organization. Most controls below need the Owner role or, on the Enterprise plan, the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); the [permissions table](/docs/claude-tag/admins/restrict-access.md#permissions-by-role) lists each action and who can take it.
22Access and organization-wide behavior are set at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), per scope (a scope is a channel, a workspace, or your whole organization), so the same agent can work differently in different channels. Each scope has its own page on the **Channels** tab under **Claude's access**, and the **Slack** page there covers your whole organization. Most controls below need the Owner role or, on the Enterprise plan, the [**Claude Tag Admin** permission](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); the [permissions table](https://claude.com/docs/claude-tag/admins/restrict-access.md#permissions-by-role) lists each action and who can take it.
2323
2424| Setting | What it does | More |
2525| :- | :- | :- |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) |
27| Managed by | Which other Slack channels' members can write a channel's standing instructions by asking Claude, including from a private channel. On the Enterprise plan, an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) sets it on the **Admin** tab of the channel's Configure page. | [Manage a channel's instructions from another channel](/docs/claude-tag/admins/managed-by.md) |
28| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. **Respond automatically** exists only on channels, not on workspaces or your whole organization. Channel members can change it too, from Slack or the channel's Configure page, unless the scope's [**Channel member edits**](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) |
29| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins) |
30| Connectors | Which systems Claude can reach from each channel | [Add a connector](/docs/claude-tag/admins/add-connections.md) |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) |
27| Managed by | Which other Slack channels' members can write a channel's standing instructions by asking Claude, including from a private channel. On the Enterprise plan, an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) sets it on the **Admin** tab of the channel's Configure page. | [Manage a channel's instructions from another channel](https://claude.com/docs/claude-tag/admins/managed-by.md) |
28| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. **Respond automatically** exists only on channels, not on workspaces or your whole organization. Channel members can change it too, from Slack or the channel's Configure page, unless the scope's [**Channel member edits**](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**. | [Turn automatic replies on or off](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) |
29| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins) |
30| Connectors | Which systems Claude can reach from each channel | [Add a connector](https://claude.com/docs/claude-tag/admins/add-connections.md) |
3131| Model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) |
3232| Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) |
3333| Environment | Which cloud environment a scope's sessions run in | [Configure the environment for a scope](#configure-the-environment-for-a-scope) |
34| Enable Claude Tag | Turns Claude on or off in a scope. On the **Slack** page, the switch is labeled **Respond in all channels** or **Respond in channels** | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
35| Claude Tag version | Which generation answers in a scope (**New** or **Legacy**) | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
34| Enable Claude Tag | Turns Claude on or off in a scope. On the **Slack** page, the switch is labeled **Respond in all channels** or **Respond in channels** | [Turn Claude Tag on or off and set the version for a scope](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
35| Claude Tag version | Which generation answers in a scope (**New** or **Legacy**) | [Turn Claude Tag on or off and set the version for a scope](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
3636
3737### Claude Tag connectors are separate from personal connectors
3838
39An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) configures Claude Tag connectors, plugins, and skills, and they apply per scope. They are separate from the personal connectors, skills, or MCP servers an individual user has set up in their own claude.ai or Claude Desktop account. A user's personal connectors are not part of a channel's configuration, and the channel's connectors are not listed among that user's personal connectors in claude.ai. Claude can [use a user's personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors.md) for that user's own tasks, after the user allows it. That work runs with the user's permissions and is recorded under their name. Projects in claude.ai are separate too. Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project. Put standing guidance for a channel in its [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions).
39An Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) configures Claude Tag connectors, plugins, and skills, and they apply per scope. They are separate from the personal connectors, skills, or MCP servers an individual user has set up in their own claude.ai or Claude Desktop account. A user's personal connectors are not part of a channel's configuration, and the channel's connectors are not listed among that user's personal connectors in claude.ai. Claude can [use a user's personal connectors in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for that user's own tasks, after the user allows it. That work runs with the user's permissions and is recorded under their name. Projects in claude.ai are separate too. Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project. Put standing guidance for a channel in its [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions).
4040
41To give Claude access to a tool that isn't in the **Add a connector** list, including a custom MCP server, see [Connect a service that isn't in the list](/docs/claude-tag/admins/connections/custom.md).
41To give Claude access to a tool that isn't in the **Add a connector** list, including a custom MCP server, see [Connect a service that isn't in the list](https://claude.com/docs/claude-tag/admins/connections/custom.md).
4242
4343## Change behavior from the channel
4444
from line 46
4646
4747| To change | Say something like | More |
4848| :- | :- | :- |
49| How Claude formats output | "remember for this channel: post reports as a table" | [Memory](/docs/claude-tag/users/memory.md) |
50| How chatty Claude is | "ask before posting anything longer than a screen" | [Memory](/docs/claude-tag/users/memory.md) |
51| When Claude follows a thread | "stay quiet in this thread unless someone tags you" | [Control when Claude Tag responds](/docs/claude-tag/users/when-claude-responds.md) |
52| What Claude does on a schedule | "every morning at 9, post a digest of open threads" | [Set up routines](/docs/claude-tag/users/proactivity.md) |
53| What Claude remembers | "what do you remember about this channel?" then correct it | [Memory](/docs/claude-tag/users/memory.md) |
49| How Claude formats output | "remember for this channel: post reports as a table" | [Memory](https://claude.com/docs/claude-tag/users/memory.md) |
50| How chatty Claude is | "ask before posting anything longer than a screen" | [Memory](https://claude.com/docs/claude-tag/users/memory.md) |
51| When Claude follows a thread | "stay quiet in this thread unless someone tags you" | [Control when Claude Tag responds](https://claude.com/docs/claude-tag/users/when-claude-responds.md) |
52| What Claude does on a schedule | "every morning at 9, post a digest of open threads" | [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md) |
53| What Claude remembers | "what do you remember about this channel?" then correct it | [Memory](https://claude.com/docs/claude-tag/users/memory.md) |
5454
5555Changes in the table above are saved to channel memory; verify one stuck by asking what it remembers.
5656
57Members can also tailor how Claude works in the channel from its Configure page on claude.ai. The **Configure** link in the footer of any Claude reply in the channel opens it, and if a member sends [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) in the channel, Claude replies with a link to it. Anyone in the channel who is also a member of your Claude organization can edit settings for that channel there, unless an admin has [restricted editing to admins](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The **Channel instructions** field on that page holds standing guidance that outranks memory. See [configure Claude for a channel](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel).
57Members can also tailor how Claude works in the channel from its Configure page on claude.ai. The **Configure** link in the footer of any Claude reply in the channel opens it, and if a member sends [`@Claude !configure`](https://claude.com/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) in the channel, Claude replies with a link to it. Anyone in the channel who is also a member of your Claude organization can edit settings for that channel there, unless an admin has [restricted editing to admins](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The **Channel instructions** field on that page holds standing guidance that outranks memory. See [configure Claude for a channel](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel).
5858
59The Configure page also shows the channel's resolved access. Its **Tools and access** tab lists the channel's resolved connections and any allowed domains. Members can see those lists but not change them there. The same tab's **Plugins** card lists the plugins available to Claude in the channel; members can add plugins there unless an admin has [restricted editing to admins](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The card groups plugins **Added by your admin**, which members can't remove, separately from plugins **Added by members**, which members can remove. The Configure page's **Routines** tab lists the channel's [routines](/docs/claude-tag/users/proactivity.md) with each one's schedule, status, and last run.
59The Configure page also shows the channel's resolved access. Its **Tools and access** tab lists the channel's resolved connections and any allowed domains. Members can see those lists but not change them there. The same tab's **Plugins** card lists the plugins available to Claude in the channel; members can add plugins there unless an admin has [restricted editing to admins](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The card groups plugins **Added by your admin**, which members can't remove, separately from plugins **Added by members**, which members can remove. The Configure page's **Routines** tab lists the channel's [routines](https://claude.com/docs/claude-tag/users/proactivity.md) with each one's schedule, status, and last run.
6060
61On the Enterprise plan, an Owner can name [channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for a channel, and so can a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) whose role also sets **Identity & Access** to **Can manage**. Channel managers set the channel's default model, repositories, connections, and plugins from the same page.
61On the Enterprise plan, an Owner can name [channel managers](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for a channel, and so can a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) whose role also sets **Identity & Access** to **Can manage**. Channel managers set the channel's default model, repositories, connections, and plugins from the same page.
6262
6363## Choose the model for a scope
6464
from line 70
7070
7171When you change the setting, new sessions start on the new model. A thread already underway switches to it at the next message anyone posts there, unless someone in that thread has already had Claude switch models. The footer of each Claude reply in Slack names the model that handled it, so you can confirm what a scope is running.
7272
73Channel members can also change the model from Slack. Asking Claude in a thread switches that thread, and asking it to make a model the channel default changes this setting for the channel, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**. See [choose the model Claude Tag uses](/docs/claude-tag/users/models.md).
73Channel members can also change the model from Slack. Asking Claude in a thread switches that thread, and asking it to make a model the channel default changes this setting for the channel, unless the scope's [Channel member edits](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**. See [choose the model Claude Tag uses](https://claude.com/docs/claude-tag/users/models.md).
7474
7575### Models your organization allows
7676
from line 77
7777On the Team plan, Claude Tag doesn't apply the [`availableModels` allowlist](https://code.claude.com/docs/en/model-config#restrict-model-selection) from your Claude Code [server-managed settings](https://code.claude.com/docs/en/server-managed-settings), and on the Enterprise plan it applies the allowlist in only some organizations.
7878
7979* **Where the allowlist doesn't apply**: Claude offers your organization's full Claude Tag model list, both when someone asks it to switch and in the model selector for direct messages. It starts sessions on a scope's **Model** setting without checking that model against the allowlist. The **Model** picker in admin settings still lists only allowed models.
80* **Where the allowlist applies**: sessions in a channel run as the [agent identity](/docs/claude-tag/concepts/agent-identity.md) you provisioned and without your server-managed settings. When someone in a channel asks Claude to switch models, Claude may decline a model outside the allowlist, though that check doesn't always run. In one-to-one direct messages from a member whose linked Claude account belongs to your organization, Claude runs on that member's own account, which receives your allowlist; see [Restrict model selection](https://code.claude.com/docs/en/model-config#restrict-model-selection) for what happens to a model the allowlist blocks.
80* **Where the allowlist applies**: sessions in a channel run as the [agent identity](https://claude.com/docs/claude-tag/concepts/agent-identity.md) you provisioned and without your server-managed settings. When someone in a channel asks Claude to switch models, Claude may decline a model outside the allowlist, though that check doesn't always run. In one-to-one direct messages from a member whose linked Claude account belongs to your organization, Claude runs on that member's own account, which receives your allowlist; see [Restrict model selection](https://code.claude.com/docs/en/model-config#restrict-model-selection) for what happens to a model the allowlist blocks.
8181
8282In either case, Claude Tag offers only the models it supports, so a model your allowlist includes can be absent in Slack.
8383
from line 86
8686Claude also relies on these models in Slack even when no scope's **Model** setting names them. On the Enterprise plan, keep them turned on under **Model access** on your [**Models**](https://claude.ai/admin-settings/models) page:
8787
8888* **Claude Sonnet 5**: in channel sessions and routines, a permission checker reviews each action Claude is about to take, and that checker runs on Claude Sonnet 5. While the model is off, the checker blocks actions it would otherwise allow, such as API calls, unless an [auto mode allow rule](#auto-mode-allow-rules) names them.
89* **Claude Opus 5**: tasks that use a member's [personal connectors](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) go through checks that run on Claude Opus 5, whichever model the member's thread runs on. While the model is off, Claude declines those tasks.
89* **Claude Opus 5**: tasks that use a member's [personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) go through checks that run on Claude Opus 5, whichever model the member's thread runs on. While the model is off, Claude declines those tasks.
9090
9191### Allow fast mode
9292
93[Fast mode](/docs/claude-tag/users/models.md#run-a-thread-in-fast-mode) gives a thread faster output at a higher cost per token. Claude in Slack and Claude Code share one fast mode setting, so turning it on allows fast mode in both. The setting is off by default on the Team and Enterprise plans.
93[Fast mode](https://claude.com/docs/claude-tag/users/models.md#run-a-thread-in-fast-mode) gives a thread faster output at a higher cost per token. Claude in Slack and Claude Code share one fast mode setting, so turning it on allows fast mode in both. The setting is off by default on the Team and Enterprise plans.
9494
9595To allow fast mode, an Owner goes to [**Admin settings > Claude Code**](https://claude.ai/admin-settings/claude-code) and turns on the **Fast mode** toggle under **Capabilities**. Fast mode draws from usage credits, so also turn those on at [**Admin settings > Usage**](https://claude.ai/admin-settings/usage). For an organization billed through AWS Marketplace, the toggle is locked.
9696
from line 97
9797Turning the toggle on has these effects in Slack:
9898
9999* **Speed**: every session starts at standard speed until someone turns fast mode on for it, and no per-channel setting starts sessions in fast mode
100* **Who turns it on**: any member who can message Claude in a channel can turn fast mode on for a thread there by sending [`@Claude !fast`](/docs/claude-tag/users/commands#turn-fast-mode-on-or-off)
100* **Who turns it on**: any member who can message Claude in a channel can turn fast mode on for a thread there by sending [`@Claude !fast`](https://claude.com/docs/claude-tag/users/commands#turn-fast-mode-on-or-off)
101101* **Model**: when a thread is on a model other than Opus, such as Sonnet, `!fast` moves it to the newest Opus model among the [models your organization allows](#models-your-organization-allows), and the thread stays on that model after `!fast off`
102* **Cost**: a channel thread in fast mode bills to your organization like other [channel work](/docs/claude-tag/admins/set-spend-limit.md#how-claude-tag-usage-is-billed), at the [fast mode rates](https://code.claude.com/docs/en/fast-mode#understand-the-cost-tradeoff)
102* **Cost**: a channel thread in fast mode bills to your organization like other [channel work](https://claude.com/docs/claude-tag/admins/set-spend-limit.md#how-claude-tag-usage-is-billed), at the [fast mode rates](https://code.claude.com/docs/en/fast-mode#understand-the-cost-tradeoff)
103103
104104## Configure the environment for a scope
105105
106Claude runs every channel session in a sandbox that starts with a standard set of tools. When a channel's work needs something that sandbox doesn't have, such as a language runtime, a database client, a set of environment variables, or broader web access, give the channel an environment. An environment is an [organization-shared cloud environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments): you create it once, then choose it on a scope, meaning a channel, a workspace, or the **Slack** page for your whole organization. Both steps take an Owner; a [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can't change a channel's environment.
106Claude runs every channel session in a sandbox that starts with a standard set of tools. When a channel's work needs something that sandbox doesn't have, such as a language runtime, a database client, a set of environment variables, or broader web access, give the channel an environment. An environment is an [organization-shared cloud environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments): you create it once, then choose it on a scope, meaning a channel, a workspace, or the **Slack** page for your whole organization. Both steps take an Owner; a [channel manager](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can't change a channel's environment.
107107
108108### Decide what goes in the environment
109109
from line 113
113113| :- | :- |
114114| A tool installed before Claude starts, such as a runtime or a database client | The environment's setup script, a Bash script whose installs are on disk before Claude starts work |
115115| A value every session should see, such as a deployment target or a feature flag | The environment's environment variables, as `KEY=value` pairs, one per line |
116| Web access without a credential | The environment's network access level; see [broad web access through the environment](/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) |
117| An API key, token, or other credential | A [connector](/docs/claude-tag/admins/add-connections.md), never an environment variable |
118| Setup for one repository, such as installing its dependencies | That repository's `CLAUDE.md`; see [install project dependencies](/docs/claude-tag/admins/configure-github.md#install-project-dependencies) |
116| Web access without a credential | The environment's network access level; see [broad web access through the environment](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) |
117| An API key, token, or other credential | A [connector](https://claude.com/docs/claude-tag/admins/add-connections.md), never an environment variable |
118| Setup for one repository, such as installing its dependencies | That repository's `CLAUDE.md`; see [install project dependencies](https://claude.com/docs/claude-tag/admins/configure-github.md#install-project-dependencies) |
119119
120Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. There is no separate secrets store. A connector stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) describes how. A connector in a bundle also travels with that bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
120Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. There is no separate secrets store. A connector stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) describes how. A connector in a bundle also travels with that bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
121121
122122### Create the environment and choose it on a scope
123123
from line 144
1441443. The **Environment** setting on the **Slack** page
1451454. The [organization's default environment](https://code.claude.com/docs/en/cloud-environments#the-default-environment), which an Owner chooses under **Cloud sessions** at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code)
146146
147If you haven't chosen an environment on a scope, its picker shows **Organization default**, but sessions there may still run on an environment you chose on the workspace or on the **Slack** page. In a channel where Claude runs with [channel-only access](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works) because a guest is present, sessions run on the standard environment regardless of these settings. If a channel's sessions aren't on the environment you expect, see [channel sessions use the wrong environment](/docs/claude-tag/admins/troubleshooting.md#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
147If you haven't chosen an environment on a scope, its picker shows **Organization default**, but sessions there may still run on an environment you chose on the workspace or on the **Slack** page. In a channel where Claude runs with [channel-only access](https://claude.com/docs/claude-tag/admins/restrict-access.md#how-channel-only-works) because a guest is present, sessions run on the standard environment regardless of these settings. If a channel's sessions aren't on the environment you expect, see [channel sessions use the wrong environment](https://claude.com/docs/claude-tag/admins/troubleshooting.md#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
148148
149149## Auto mode allow rules
150150
from line 159
159159The rules list has three properties:
160160
161161* **Limits:** a scope holds up to 50 rules, and each rule can be up to 1,024 characters
162* **Inheritance:** rules you set on a workspace or on the [**Slack** page](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit) (the organization-wide root) carry down to the channels beneath, the way [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#custom-instructions) stack. A channel's own rules add to those and never replace them, so put a rule on a single channel's scope to pre-approve an action there without changing any other channel.
162* **Inheritance:** rules you set on a workspace or on the [**Slack** page](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit) (the organization-wide root) carry down to the channels beneath, the way [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#custom-instructions) stack. A channel's own rules add to those and never replace them, so put a rule on a single channel's scope to pre-approve an action there without changing any other channel.
163163* **Access:** you edit the list with the same admin access as the scope's other **Advanced** settings
164164
165165> [!WARNING]
from line 172
172172
173173## Related resources
174174
175* [Settings map](/docs/claude-tag/concepts/settings-map.md): every settings surface, including spend limits and personal connectors
176* [What Claude Tag remembers](/docs/claude-tag/users/memory.md): how channel instructions are stored, shared, and corrected
177* [Good habits for working with Claude Tag](/docs/claude-tag/users/good-habits.md): phrasings that make recurring output consistent
178* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why access is set per channel
175* [Settings map](https://claude.com/docs/claude-tag/concepts/settings-map.md): every settings surface, including spend limits and personal connectors
176* [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md): how channel instructions are stored, shared, and corrected
177* [Good habits for working with Claude Tag](https://claude.com/docs/claude-tag/users/good-habits.md): phrasings that make recurring output consistent
178* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why access is set per channel
179179
claude-tag/admins/federated-access/authorization-server Changed · +20 / -20 lines
from line 10
1010>
1111> Authorization servers are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Authorization servers** section. Connecting a server needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13With an authorization server connection, Claude presents a short-lived identity token to an OAuth 2.0 authorization server you run, receives one of your access tokens in return, and calls your APIs with it. No long-lived credential for your systems is stored in Claude, and [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) holds each access token only until it expires. The identity token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your server decides whether to issue a token for it.
13With an authorization server connection, Claude presents a short-lived identity token to an OAuth 2.0 authorization server you run, receives one of your access tokens in return, and calls your APIs with it. No long-lived credential for your systems is stored in Claude, and [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) holds each access token only until it expires. The identity token names your organization and the [agent](https://claude.com/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your server decides whether to issue a token for it.
1414
15Choose this when you run an authorization server that issues tokens for your APIs. If your own service will verify the identity token on every request instead, [connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md). If a vendor's API gave you a private key to sign assertions with (Salesforce, for example), use the [OAuth 2.0 JWT bearer](/docs/claude-tag/admins/connections/custom.md#oauth-2-0-jwt-bearer) credential type instead; the console labels this page's connection **Authorization server**.
15Choose this when you run an authorization server that issues tokens for your APIs. If your own service will verify the identity token on every request instead, [connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md). If a vendor's API gave you a private key to sign assertions with (Salesforce, for example), use the [OAuth 2.0 JWT bearer](https://claude.com/docs/claude-tag/admins/connections/custom.md#oauth-2-0-jwt-bearer) credential type instead; the console labels this page's connection **Authorization server**.
1616
1717Two terms recur on this page. The **subject check** is what your server does to every identity token, confirming it belongs to your organization. The **connection check** is the probe the console runs when a gateway is connected; it doesn't run for token endpoints.
1818
from line 26
2626 * isn't an IP address, a private-network name, an Anthropic-owned host, or a cloud token-exchange host
2727* The token endpoint is on a different host from the APIs Claude will call with the returned token, for example `auth.example.com` and `api.example.com`, or its address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`.
2828* Your server can reach `https://identity.anthropic.com` to fetch Anthropic's signing keys.
29* An organization can register up to 5 [gateways](/docs/claude-tag/admins/federated-access/connect-a-gateway.md), and an authorization server's audience address (its **Issuer URL** value, or its token endpoint when that field is empty) counts as one.
29* An organization can register up to 5 [gateways](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md), and an authorization server's audience address (its **Issuer URL** value, or its token endpoint when that field is empty) counts as one.
3030
3131## Copy the values from the console
3232
from line 37
3737| Issuer | `https://identity.anthropic.com/agents`, matched exactly. The OpenID Connect (OIDC) discovery document is at `https://identity.anthropic.com/agents/.well-known/openid-configuration`. |
3838| JWKS URL | The JSON Web Key Set (JWKS) named by `jwks_uri` in the discovery document, `https://identity.anthropic.com/agents/jwks.json`. Accept ES256 only. Select the key by `kid`, and refetch the JWKS on an unknown `kid` before rejecting the token. |
3939| Audience | Your authorization server's issuer identifier, as you enter it in the **Issuer URL** field when you connect the server, for example `https://auth.example.com`. It must be an HTTPS URL on the same host as the token endpoint. If your server requires the token endpoint URL as the audience instead, leave **Issuer URL** empty and the audience is the token endpoint address as the console stores it (the host lowercased, a bare trailing slash dropped, the rest kept as entered). Either way, copy the **Audience** row into your verifier rather than typing it. The `aud` claim is a JSON array with one element. Accept only this exact value, not any address on your host. |
40| Subject prefix | `wimse://identity.anthropic.com/org/<your organization ID>/agent/`. Every token's `sub` claim starts with this prefix and ends with one agent's ID; see the [subject](/docs/claude-tag/admins/federated-access/token-reference.md#subject) format. Agent IDs aren't shown in the console; your server learns them from the tokens it receives, and they change, for example when a Slack channel is deleted and recreated. |
40| Subject prefix | `wimse://identity.anthropic.com/org/<your organization ID>/agent/`. Every token's `sub` claim starts with this prefix and ends with one agent's ID; see the [subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#subject) format. Agent IDs aren't shown in the console; your server learns them from the tokens it receives, and they change, for example when a Slack channel is deleted and recreated. |
4141| Tenant | Your organization ID, the value between `/org/` and `/agent/` in the **Subject prefix**, carried in every token as the `tenant` claim. |
4242| Expiry | Tokens expire 10 minutes after they're issued. Check `exp`, allowing up to 60 seconds of clock skew. |
4343
from line 54
5454Your server must:
5555
5656* Verify the token with a standard JWT or OIDC library configured with the issuer, JWKS URL, audience, and expiry from [Copy the values from the console](#copy-the-values-from-the-console).
57* Check the subject. Where your use case allows, accept only the full subjects of your own agents, and update that list when a Slack channel is deleted and recreated. At minimum, reject every token whose `sub` doesn't start with your **Subject prefix**, or equivalently pin `iss` and reject every token whose `tenant` isn't your organization ID. This check is required because every organization's tokens come from the same issuer; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The console's connection check doesn't run for token endpoints, so nothing tests this check for you.
57* Check the subject. Where your use case allows, accept only the full subjects of your own agents, and update that list when a Slack channel is deleted and recreated. At minimum, reject every token whose `sub` doesn't start with your **Subject prefix**, or equivalently pin `iss` and reject every token whose `tenant` isn't your organization ID. This check is required because every organization's tokens come from the same issuer; see [Authorize on the subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The console's connection check doesn't run for token endpoints, so nothing tests this check for you.
5858* Decide what the agent may do, for example from the agent ID at the end of `sub`, and issue an access token for it. Tokens may carry additional opaque claims; ignore claims you don't recognize.
5959* Return `200` with a JSON body: `access_token`, `token_type` (`Bearer`, compared without regard to case, and may be omitted), and `expires_in` in seconds.
6060
from line 84
8484
8585Optionally enter a **Resource**, the API the returned token should be scoped to as an absolute URI (for example `https://api.example.com`), and a **Scope**, space-separated scopes to request. In **Allowed API hosts**, add the hosts Claude may call with the returned token, for example `api.example.com`. A wildcard as the leftmost label matches any subdomain. An entry or wildcard can cover the token endpoint's host only when the endpoint's address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`. In that case, list the paths Claude may use, such as `/graphql`, under **Allowed API paths**. A listed path covers everything under it, and a path that overlaps the token endpoint's folder isn't allowed. Then choose a bundle from the **Access bundle** list (or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**) and click **Connect server**.
8686
87This creates a [connection](/docs/claude-tag/admins/add-connections.md) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies.
87This creates a [connection](https://claude.com/docs/claude-tag/admins/add-connections.md) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies.
8888
8989The **Authorization servers** table lists each server by its **Token endpoint**, with its **Access bundle**, its **Allowed hosts**, when it was **Added**, and a **Remove** action. The audience address also appears in the **Gateways** table with its check marked **Skipped** and a note that a connected authorization server uses it.
9090
9191## Let agents use the APIs
9292
93Claude uses the connection in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
93Claude uses the connection in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
9494
95Claude also needs to know what the APIs are for. Add a line like this to the scope's [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
95Claude also needs to know what the APIs are for. Add a line like this to the scope's [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
9696
9797```text wrap theme={null}
9898The internal orders API is at https://api.example.com; see GET /openapi.json for what it offers. Authentication is already set up.
from line 100
100100
101101The exchange happens in Agent Proxy, outside Claude's sandbox, so neither the identity token nor your access token is visible to Claude, and Claude can't perform the exchange itself.
102102
103New threads pick up the connection on their own. In a thread already running, ask Claude to use the API and name its host. If Claude still can't, send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
103New threads pick up the connection on their own. In a thread already running, ask Claude to use the API and name its host. If Claude still can't, send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
104104
105105## Verify the connection
106106
107[Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
107[Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
108108
109109In a channel where the connection applies, start a new thread and ask Claude to make a small read:
110110
from line 112
112112@Claude call GET /openapi.json on https://api.example.com and tell me what the API offers.
113113```
114114
115Then check your authorization server's logs for a JWT bearer grant whose token has your **Subject prefix**, and your API's logs for a request carrying the access token it issued. If the grant was refused, your server's own error is the reason; Claude sees only that the request failed. See [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows.
115Then check your authorization server's logs for a JWT bearer grant whose token has your **Subject prefix**, and your API's logs for a request carrying the access token it issued. If the grant was refused, your server's own error is the reason; Claude sees only that the request failed. See [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows.
116116
117117## Remove the server
118118
from line 123
123123Five messages come up while connecting:
124124
125125* **"The issuer URL must be an https URL on the same host as the token endpoint. Leave it empty to use the token endpoint as the audience."**: the **Issuer URL** value is not an HTTPS URL on the token endpoint's host. Enter the issuer identifier your server uses there, or clear the field.
126* **"This token endpoint is already connected in the bundle"**: the server already has its one connection. Apply that bundle where you need the server instead; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
126* **"This token endpoint is already connected in the bundle"**: the server already has its one connection. Apply that bundle where you need the server instead; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
127127* **"This organization has reached its limit of 5 registered gateways, which includes token endpoints"**: remove an unused row from the **Gateways** table first.
128128* **"The allowed hosts can't include the token endpoint's host"**: an **Allowed API hosts** entry, or a wildcard in it, covers the token endpoint's host, and the endpoint's address has no folder of its own. Put the token endpoint on a different host from the APIs, or use a token endpoint address with a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`.
129* **"That address is already connected as a gateway. Enter your authorization server's own addresses, or remove the gateway first."**: the token endpoint, or the **Issuer URL** value, is the address of a gateway connected in one of your bundles. Enter the server's own addresses, or delete that gateway's connection from its bundle first, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes.
129* **"That address is already connected as a gateway. Enter your authorization server's own addresses, or remove the gateway first."**: the token endpoint, or the **Issuer URL** value, is the address of a gateway connected in one of your bundles. Enter the server's own addresses, or delete that gateway's connection from its bundle first, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes.
130130
131For other dialog messages, see [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md).
131For other dialog messages, see [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md).
132132
133If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
133If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
134134
135135## Related resources
136136
137* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connection model
138* [Attach a bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md): where a connection applies
139* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
140* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md): the alternative where your own service verifies the token on every request
141* [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
137* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the bundle and connection model
138* [Attach a bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): where a connection applies
139* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
140* [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md): the alternative where your own service verifies the token on every request
141* [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
142142
claude-tag/admins/federated-access/aws Changed · +18 / -18 lines
from line 10
1010>
1111> AWS roles are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting a role needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13With an AWS role connection, Claude signs in to an IAM role in your AWS account with a short-lived identity token and calls AWS with the role's permissions. No access key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your role's trust policy decides which tokens to accept. If someone else manages your AWS account, give them the values from the console and the trust policy below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
13With an AWS role connection, Claude signs in to an IAM role in your AWS account with a short-lived identity token and calls AWS with the role's permissions. No access key is stored in Claude. The token names your organization and the [agent](https://claude.com/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your role's trust policy decides which tokens to accept. If someone else manages your AWS account, give them the values from the console and the trust policy below; the console steps need an organization Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
1414
1515## Before you begin
1616
from line 63
6363}
6464```
6565
66Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`).
66Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`).
6767
6868The prefix condition is the minimum, and it admits every agent in your organization. Where your use case allows, pin the role to specific agents instead, which is the strongest form: use `StringEquals` on `identity.anthropic.com/agents:sub` with one full subject, or a JSON array of full subjects. The console doesn't show agent IDs, so you learn a subject from CloudTrail after a first sign-in under the prefix condition. Agent IDs change when a Slack channel is deleted and recreated, so update the policy when that happens.
6969
from line 83
8383
8484**3. Narrow the allowed AWS hosts**
8585
86The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections.md#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here.
86The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here.
8787
8888**4. Confirm the trust policy**
8989
from line 91
9191
9292**5. Choose a bundle and connect**
9393
94Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](/docs/claude-tag/admins/add-connections.md) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies.
94Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](https://claude.com/docs/claude-tag/admins/add-connections.md) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies.
9595
9696The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the role's ARN and an **AWS role** chip beneath it, and **Check trust policy** and **Remove** are under **Actions**.
9797
9898## Let agents use the role
9999
100Claude uses the role in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
100Claude uses the role in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
101101
102Claude also needs to know what the role is for. Add a line like this to the scope's [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
102Claude also needs to know what the role is for. Add a line like this to the scope's [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
103103
104104```text wrap theme={null}
105105Use the AWS CLI to read the S3 bucket example-reports in us-west-2. AWS access is already set up.
106106```
107107
108Claude calls AWS with `curl`, an AWS SDK, or the AWS CLI, as with an [AWS SigV4 credential](/docs/claude-tag/admins/connections/custom.md#aws-sigv4). [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) signs each request at the network boundary with the role's temporary credentials, so the sandbox never holds them.
108Claude calls AWS with `curl`, an AWS SDK, or the AWS CLI, as with an [AWS SigV4 credential](https://claude.com/docs/claude-tag/admins/connections/custom.md#aws-sigv4). [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) signs each request at the network boundary with the role's temporary credentials, so the sandbox never holds them.
109109
110New threads pick up the connection on their own. In a thread already running, ask Claude to use AWS. If Claude still can't, send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
110New threads pick up the connection on their own. In a thread already running, ask Claude to use AWS. If Claude still can't, send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
111111
112112## Verify the connection
113113
114[Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
114[Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
115115
116116In a channel where the role's connection applies, start a new thread and ask Claude to run a connectivity check. The check is Claude's own request to `sts.amazonaws.com`, so keep `*.amazonaws.com` under the connection's **Allowed hosts** for this check, or add `sts.amazonaws.com` if you already narrowed the list. The sign-in itself needs no entry there. After the check passes, remove `sts.amazonaws.com` again if you added it, or narrow the wildcard. While it is listed, Claude can send any STS request signed with the role's credentials. If the role is allowed to assume another role, the credentials AWS returns are readable in Claude's sandbox. The call needs no permissions policy on the role. Send Claude this prompt:
117117
from line 132
132132* `AccessDenied` on the sign-in means the trust policy didn't accept the token. Check the `sub` condition and the condition-key prefix.
133133* A denied action after a successful sign-in means AWS denied the action. Check the role's permissions policy first, then any bucket policy, permissions boundary, or service control policy.
134134
135See [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows.
135See [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows.
136136
137137To disconnect a role, click **Remove** in the role's row of the **Cloud roles** table, then **Remove role** in the confirmation. Claude stops using the role within about a minute, in existing threads as well as new ones, and the connection is removed from its bundle. Credentials from an earlier sign-in stay valid in AWS until they expire, within 1 hour; they're held only by Agent Proxy, never by Claude's sandbox.
138138
from line 140
140140
141141Two messages come up while connecting:
142142
143* **"This role is already connected in the bundle"**: the role already has its one connection. Apply that bundle where you need the role instead; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
143* **"This role is already connected in the bundle"**: the role already has its one connection. Apply that bundle where you need the role instead; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
144144* **"Enter a role ARN like `arn:aws:iam::123456789012:role/ClaudeTag`"**: the **Role ARN** field rejected the value, most often because the ARN is in the AWS GovCloud (US) or AWS China partition, which can't be connected.
145145
146For other dialog messages, see [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md).
146For other dialog messages, see [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md).
147147
148If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
148If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
149149
150150## Related resources
151151
152* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connection model
153* [Attach a bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md): where a role connection applies
154* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
155* [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
156* [AWS SigV4 credential](/docs/claude-tag/admins/connections/custom.md#aws-sigv4): the stored-key alternative, and how Claude signs AWS requests
152* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the bundle and connection model
153* [Attach a bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): where a role connection applies
154* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
155* [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
156* [AWS SigV4 credential](https://claude.com/docs/claude-tag/admins/connections/custom.md#aws-sigv4): the stored-key alternative, and how Claude signs AWS requests
157157
claude-tag/admins/federated-access/connect-a-gateway Changed · +15 / -15 lines
from line 10
1010>
1111> Gateways are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Gateways** section. Connecting a gateway needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13A gateway is a service you run between Claude and your internal systems. Every request Claude sends it carries a signed identity token naming your organization and the [agent](/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel). The gateway checks the token, decides what that agent may do, and forwards the request with your own credentials. No long-lived credential for your systems is stored in Claude.
13A gateway is a service you run between Claude and your internal systems. Every request Claude sends it carries a signed identity token naming your organization and the [agent](https://claude.com/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel). The gateway checks the token, decides what that agent may do, and forwards the request with your own credentials. No long-lived credential for your systems is stored in Claude.
1414
1515Two terms recur on this page. The **subject check** is what your gateway does to every token, confirming it belongs to your organization. The **connection check** is what the console does once, when you connect the gateway, confirming that your gateway performs the subject check.
1616
from line 38
3838| Control subject | A reserved test identity in your organization, copied from the dialog. Anthropic uses it only for the connection check. |
3939| Expiry | Tokens expire 10 minutes after they're issued. Check `exp`, allowing up to 60 seconds of clock skew. |
4040
41The subject check is yours to implement, and it's required, because every organization's tokens come from the same issuer; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). Implement the check in one of two forms, strongest first:
41The subject check is yours to implement, and it's required, because every organization's tokens come from the same issuer; see [Authorize on the subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). Implement the check in one of two forms, strongest first:
4242
4343* Accept only an explicit list of your own agents' full subjects, when your use case allows it. The sample gateway does this by default and offers the prefix form below as an opt-in setting. Agent IDs change when a Slack channel is deleted and recreated, so you update the list when that happens.
4444* Otherwise, reject every token whose `sub` doesn't start with your **Subject prefix**, or pin `iss` and `tenant` together. The `tenant` claim is your organization ID, the same value the subject carries between `/org/` and `/agent/`, so checking it is the subject check in claim form. This is the minimum.
from line 78
7878
7979## Let agents reach the gateway
8080
81Claude uses the gateway in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
81Claude uses the gateway in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
8282
83Claude also needs to know the gateway exists. Add a line like this to the scope's [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
83Claude also needs to know the gateway exists. Add a line like this to the scope's [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
8484
8585```text wrap theme={null}
8686Internal APIs are behind https://gateway.example.com. Call GET /list-services there to see what is available.
from line 88
8888
8989The sample gateway serves `GET /list-services` for this; an OpenAPI document named in the instructions works as well.
9090
91New threads pick up the connection on their own. In a thread already running, ask Claude to use the gateway and include its address. If Claude still can't see the gateway, send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
91New threads pick up the connection on their own. In a thread already running, ask Claude to use the gateway and include its address. If Claude still can't see the gateway, send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
9292
9393## Verify the connection
9494
95[Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
95[Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
9696
9797In a channel where the gateway's connection applies, start a new thread and ask Claude to make a small read through the gateway:
9898
from line 100
100100@Claude call GET /list-services on https://gateway.example.com and tell me what it returns.
101101```
102102
103If your gateway logs subjects and decisions, confirm the request arrived with a token that passed every check and a subject starting with your **Subject prefix**. [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) attaches the token at the network boundary; the model and the sandbox are not given it.
103If your gateway logs subjects and decisions, confirm the request arrived with a token that passed every check and a subject starting with your **Subject prefix**. [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) attaches the token at the network boundary; the model and the sandbox are not given it.
104104
105105To disconnect a gateway, click **Remove** in the gateway's row of the **Gateways** table and confirm with **Remove gateway**. Claude stops using the gateway at once. A token issued before the removal stays valid until it expires, within 10 minutes.
106106
107107## Common errors
108108
109One message comes up while connecting. **"The check didn't pass"** means the gateway isn't reachable from the internet over HTTPS, its root route doesn't answer an empty `POST` directly, or the subject check is missing or rejects the **Control subject**. See [The check didn't pass](/docs/claude-tag/admins/federated-access/troubleshooting.md#the-check-didn%E2%80%99t-pass).
109One message comes up while connecting. **"The check didn't pass"** means the gateway isn't reachable from the internet over HTTPS, its root route doesn't answer an empty `POST` directly, or the subject check is missing or rejects the **Control subject**. See [The check didn't pass](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md#the-check-didn%E2%80%99t-pass).
110110
111A bundle-step note that the gateway is already in a bundle isn't an error; the **Access bundle** list then offers the bundles it isn't in yet. To use the gateway in more channels without adding it to another bundle, apply a bundle it's in wherever you need the gateway; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
111A bundle-step note that the gateway is already in a bundle isn't an error; the **Access bundle** list then offers the bundles it isn't in yet. To use the gateway in more channels without adding it to another bundle, apply a bundle it's in wherever you need the gateway; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
112112
113For other dialog messages, see [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md).
113For other dialog messages, see [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md).
114114
115If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
115If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
116116
117117## Related resources
118118
119* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connection model
120* [Attach a bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md): where a gateway connection applies
121* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
122* [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
119* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the bundle and connection model
120* [Attach a bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): where a gateway connection applies
121* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
122* [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
123123* [Sample gateway](https://github.com/anthropics/claude-tag-wif-gateway-sample): a reference gateway with offline tests
124124