One read of Claude Documentationclaude-docs-20261029T180705Z
16 pages moved out of 280 read.
Pages moved
16
significant first
Pages read
280
in this capture
Captured
18:07 UTC
Corpus hash
98695ed552ca
corpus-hash
What this read moved
1-16 of 16cowork/changelog Changed · +54 / -1 lines
from line 2
22
33> Release notes for Claude Desktop
44
5**v4.4212.0**
6
72026-10-29
8
9Bundled Claude Code version: 2.1.309.
10
11**General**
12
13* Added a per-site "Local network access" setting to the built-in browser's menu, with a question the first time a site tries, for sign-in pages that check a desktop agent such as Okta Verify and for sites that talk to devices on your network.
14* Added Cowork's notes to the import from Claude (third-party): where device management turned it on and no HIPAA restriction applies, Settings > Import shows the notes Cowork kept there and can add them to your Claude memory, where memory import is available.
15* Added Send to options for partner apps, such as Canva, in the Share menu when a Claude Doc is open on its own page.
16* Changed `disableBrowserExternalNavigation` and `browserExternalPageTools` in a device's Claude Code managed settings (`managed-settings.json`, or its MDM or HKLM policy) to apply even when the claude.ai admin console also has managed settings.
17* Removed opening the application menu by pressing Alt on its own on GNOME, so that switching keyboard layouts with Alt+Shift no longer opens it. F10 still opens the menu.
18* Fixed a reply with two or more cards, such as weather or message drafts, showing only one of them, or showing a card with the wrong pictures or places.
19* Fixed background computer use treating a window that had been closed as still open on another desktop, which made Claude click into nothing or ask for full-screen control.
20* Fixed the message box sometimes opening without its saved draft, and not keeping what you typed as a draft, when two windows loaded at the same time, for example right after signing in.
21* Fixed the side panel opening on its own over the conversation in a narrow window when a reply created an artifact or shared a file, which hid the reply and the message box, including from screen readers.
22
23**Code**
24
25* Changed `remoteControlAtStartup: false` in a device's Claude Code managed settings (`managed-settings.json`, or its MDM or HKLM policy) to apply even when the claude.ai admin console also has managed settings.
26* Changed SSH connections through a proxy command or jump host on Mac and Linux, where your SSH config sets no ConnectTimeout, to get a longer second try so a slow route has time to come up; the sign-in dialog for a jump host (ProxyJump) no longer closes after 30 seconds.
27* Fixed a message to a new or just-cleared SSH session being refused while the host was unreachable: it now waits and is sent when the host is back, and messages waiting for an unreachable host no longer send by themselves before your organization's settings have loaded.
28* Fixed Rewind on the first message shown in a very large session clearing the whole conversation.
29* Fixed sessions on an SSH machine losing their connection when an `sshHostCommands` command makes a new one; "Replace …'s host" is now "Create another …", available a minute after the last machine is made.
30* Fixed SSH set-up failing at once when Anthropic's download server is busy, and sessions showing only "Reconnecting" when Claude Code couldn't be set up on the host: the app now tries again, names the cause, and offers Retry now.
31* Fixed the first message after an SSH session starts or reconnects sometimes silently running without your MCP servers.
32
33**Cowork**
34
35* Fixed a generic error banner sometimes appearing beside the Paused card after safeguards flagged a message.
36* Fixed a stopped tool call showing a message written for Claude as a failure.
37* Fixed Cmd+Shift+S and Cmd+Shift+B answering on their QWERTY keys under Dvorak and other remapped keyboard layouts.
38* Fixed dismissed notices under a reply, such as crisis support or election information, coming back after leaving a chat and returning to it.
39* Fixed furigana (readings above Japanese text) in replies showing as raw HTML tags, and Find counting the hidden tag text and missing words under two readings.
40* Fixed Return in a background Mac app's text field adding a line break to the field instead of submitting it.
41
42**3P**
43
44* Added `projectsEnabled`. Set it to `false` to hide projects in Chat and Cowork. Projects are not deleted, and they come back when the setting is turned on again.
45* Added `sessionStatusLine` to show one line of text above the message box in Cowork, Chat and Code, printed by a program that the app runs. On macOS and Linux the program and every folder above it must be writable only by root, and on Windows it must be in Program Files on the system drive.
46* Added `skillScanningEnabled` (beta): run a security scan on each skill a user creates or uploads before it can be used. Skills that fail the security scan are blocked.
47* Added a per-site "Local network access" setting to the built-in browser (`builtinBrowserEnabled`). When an https site first tries to reach an app on this computer or a device on your network, the user is asked whether to allow it. `builtinBrowserBlockedDomains` can block devices, not local apps.
48* Added Escape to close a side pane of a chat or Cowork task, such as a file or connector pane, when focus is in the pane, and return focus to what opened it. While Claude is replying, Escape in a pane closes the pane, and a second Escape stops the reply.
49* (breaking) Changed an unset `desktopHome` to read as `standard` at launches after 12:00 PM PT on November 10, 2026: Unified Claude opens with Cowork on, even where `coworkTabEnabled` is `false`.
50* Changed `sshClientPath` (beta) on Windows to accept a path starting with `%LOCALAPPDATA%\` when machine-wide policy (HKLM) sets it, with `sshTransport: system-openssh`, and Claude does not run as administrator. Whoever replaces a program there can see SSH passwords and get around `sshHostAllowlist`.
51* Changed Code sessions to ask for approval before starting a dev server from `launch.json` in Auto and Bypass permissions modes, where Claude Code's sandbox (the default on macOS, Linux and WSL) or deny or ask rules in managed settings limit shell commands.
52* Changed Cowork to show "Billing issue", with no Try again button, in place of "Something went wrong" when your inference provider or gateway refuses a request with HTTP 402.
53* Changed how to keep Cowork off from 12:00 PM PT on November 10, 2026: `coworkTabEnabled: false` alone no longer does. Set `desktopHome` to `off`, which also turns Chat off and leaves only Code. Where `isClaudeCodeForDesktopEnabled` is also `false`, the app has nothing to open.
54* Changed provider API keys saved in Setup to be encrypted where the computer has secure storage. Keys saved earlier are encrypted at the next launch. Versions below 4.29 cannot read them, so after a rollback below 4.29, or a move of the app's data to another computer or account, enter the key again.
55* Fixed Settings > Usage and the token limit set with `inferenceMaxTokensPerWindow` leaving out requests that the app makes itself, such as naming a session. These now count toward the limit, and once it is reached the app stops making them, except its connection check.
56* Fixed the connection banner's Details and "Copy report for IT" not mentioning managed settings that were not fully applied. Each one is now listed as a warning, and when the connection works, apps configured from a local file also show the "Configuration may need attention" banner.
57
558**v4.29.0**
659
7602026-10-27
from line 99
4699* Changed `managedMcpServers` entries with `server: "github"` so that `pull_request_review_write` asks before every call, comment-only reviews and thread resolves included, even when `toolPolicy` allows it. Where no prompt can be shown, the call is refused. `toolPolicy` can still block it.
47100* Changed a failed `PreToolUse` or `PermissionRequest` hook with `"shell": "powershell"` to block the call on PCs without Git for Windows unless it sets `args` or `"onFailure": "continue"`. If written for Bash: remove `shell`, add `"onFailure": "block"` to keep blocking, install Git, reopen Claude.
48101* Changed an unset `desktopHome` to open Unified Claude at launches after 12:00 PM PT on November 10, 2026. With Cowork on, a set `chatSessionRetentionDays` without an equal `coworkSessionRetentionDays` keeps the current view.
49* Changed an unset `desktopHome` with Cowork on to also turn on Chat and Advanced file analysis when it starts to open Unified Claude (November 10, 2026), even if `chatTabEnabled` or `chatAdvancedFileAnalysisEnabled` is `false`.
102* Changed `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` to have no effect where an unset `desktopHome` with Cowork on starts to open Unified Claude (November 10, 2026).
50103* Changed Chat, Cowork and Code sessions to no longer start while Claude’s provider connection settings are missing, invalid or not yet fetched from your organization’s server. Claude says so at once.
51104* Changed the Microsoft 365 connector to keep each saved sign-in per `tenantId`, `clientId`, `azureCloud` and `continuousAccessEvaluation`. Connected users sign in again once after this update. Where `microsoftAuthDefaultAccount` is `enabled` on Windows, they get the account picker from then on.
52105* Improved the “Configuration sync issue” banner for a fetched configuration with no connection settings that Claude can use. It now says to contact your administrator and adds “Copy report for IT”.
third-party/claude-desktop/admin-console Changed · +25 / -12 lines
### Keep Chat and Cowork off
from line 149
149149
150150For example, if the Traders policy (ranked first) turns Code off and selects the wiki server, and the Analysts policy (ranked second) sets a token limit and selects the tickets server, a user in both groups has Code off, the Analysts token limit, and both servers. Everything these policies leave unset comes from the organization-wide settings, and a user in no listed group gets the organization-wide settings unchanged. Groups are managed on the **Groups** page under **People**, including groups synced from your identity provider.
151151
152A group's policy can also turn on Unified Claude for that group, as described under [Turn on Unified Claude](#turn-on-unified-claude).
152A group's policy can also turn on Unified Claude for that group, as described under [Turn on Unified Claude](#turn-on-unified-claude). From November 10, 2026, Unified Claude is on by default even for a group whose policy turns Cowork off, as described under [Keep Chat and Cowork off](#keep-chat-and-cowork-off).
153153
154154### Turn on Unified Claude
155155
156156[Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) combines Chat and Cowork into one experience. These switches under **Allowed surfaces** on the **Capabilities** page control Unified Claude for your organization:
157157
158* **Opt into the new Chat and Cowork unified view** turns on Unified Claude. From November 10, 2026, Unified Claude is on by default while this switch is off, unless an [exception](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude) applies, and the switch's description says so where it is.
158* **Opt into the new Chat and Cowork unified view** turns on Unified Claude. From November 10, 2026, Unified Claude is [on by default](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude) while this switch is off. Cowork is then on even where the **Cowork** switch is off.
159159* **Chat and Cowork unified view** takes the place of the separate **Chat** and **Cowork** switches when you turn on the **Opt into the new Chat and Cowork unified view** switch. Turn on the **Chat and Cowork unified view** switch to give users the unified view. Turn it off to turn Chat and Cowork off entirely. Code is not affected.
160160
161161A group's policy has the same two switches in its **Capabilities** section.
162162
163Unified Claude is in beta. In an organization with no saved configuration, the console starts with Unified Claude on and stores it when you first click **Save changes** on the **Connection** page. Where the saved configuration leaves the **Opt into the new Chat and Cowork unified view** switch off, Unified Claude stays off until you turn it on or, unless an [exception](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude) applies, until November 10, 2026. The default goes by the settings each user gets from the organization and their groups.
163Unified Claude is in beta. In an organization with no saved configuration, the console starts with Unified Claude on and stores it when you first click **Save changes** on the **Connection** page. Where the saved configuration leaves the **Opt into the new Chat and Cowork unified view** switch off, Unified Claude stays off until you turn it on or until November 10, 2026.
164164
165When you turn on Unified Claude yourself, it overrides the **Chat**, [**Advanced file analysis**](https://claude.com/docs/third-party/claude-desktop/chat.md#advanced-file-analysis), and **Cowork** switches, including where you turned one of them off.
165While Unified Claude is on, whether you turned it on or it is on by default, it overrides the **Chat**, [**Advanced file analysis**](https://claude.com/docs/third-party/claude-desktop/chat.md#advanced-file-analysis), and **Cowork** switches, including where you turned one of them off.
166166
167167> [!WARNING]
168168>
169> When you turn on Unified Claude for your organization, it is on for every group. That includes a group whose policy turns Chat or Cowork off.
169> When you turn on Unified Claude for your organization, it is on for every group. That includes a group whose policy turns Chat or Cowork off. From November 10, 2026, the default does the same, so a group whose policy turns Cowork off gets Cowork.
170170>
171> To keep Chat, advanced file analysis, and Cowork off for a group, turn off the **Chat and Cowork unified view** switch in the group's policy. Where Unified Claude is still off for your organization, set the group's switches before you turn Unified Claude on. Turn on the group's **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is on, turn it off. For a member of several groups, Unified Claude comes from the highest-ranked of their policies that sets it, even when a higher-ranked policy turns Chat or Cowork off.
171> To keep Chat and Cowork off for a group, turn off the **Chat and Cowork unified view** switch in the group's policy, as described under [Keep Chat and Cowork off](#keep-chat-and-cowork-off). Where Unified Claude is still off for your organization, set the group's switches before you turn Unified Claude on. For a member of several groups, Unified Claude comes from the highest-ranked of their policies that sets it, even when a higher-ranked policy turns Chat or Cowork off.
172172
173173To turn on Unified Claude for your whole organization, open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. Under **Allowed surfaces**, turn on the **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is off, turn it on. Click **Save changes**.
174174
175Where Unified Claude isn't on by default, you can turn it on for some groups only:
175Until November 10, 2026, you can turn on Unified Claude for some groups only:
176176
177177**1. Make sure Unified Claude is off for your organization**
178178
179Open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. If the **Opt into the new Chat and Cowork unified view** switch under **Allowed surfaces** is off, continue with the next step. If the switch is on, turn it off, set the **Chat** and **Cowork** switches that reappear, and click **Save changes**. From November 10, 2026, continue only if the switch's description doesn't say that Unified Claude is on by default.
179Open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. If the **Opt into the new Chat and Cowork unified view** switch under **Allowed surfaces** is off, continue with the next step. If the switch is on, turn it off, set the **Chat** and **Cowork** switches that reappear, and click **Save changes**.
180180
181181**2. Open the group's policy**
182182
from line 190
190190
191191Click **Save changes**.
192192
193From November 10, 2026, unless an [exception](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude) applies, these steps leave Unified Claude on by default. Until then, they turn it off for your organization or for a group:
193Until November 10, 2026, you can turn Unified Claude off again for your organization or for a group. From that date, the same changes leave Unified Claude on by default, whatever the **Chat** and **Cowork** switches say. To keep Cowork off from then on, see [Keep Chat and Cowork off](#keep-chat-and-cowork-off).
194194
195195* **For your whole organization**: open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. Under **Allowed surfaces**, turn off the **Opt into the new Chat and Cowork unified view** switch. The **Chat** and **Cowork** switches reappear in the positions they had. Switches that nobody set are at their defaults. Cowork is on, and Chat and advanced file analysis are off. Set the switches as you want, then click **Save changes**.
196* **For a group**: while Unified Claude is off for your organization, open **Organization settings**, go to the **Permission policies** page under **People**, and open the group's policy. If the policy has other settings, click **Reset to default** in the **Opt into the new Chat and Cowork unified view** row, then click **Save changes**. If the policy has no other settings, remove the policy with **Remove policy** on the **Permission policies** page. The **Chat** and **Cowork** switches then apply to the group again.
196* **For a group**: while Unified Claude is off for your organization, open **Organization settings**, go to the **Permission policies** page under **People**, and open the group's policy. If the policy has other settings, click **Reset to default** in the **Opt into the new Chat and Cowork unified view** row, then click **Save changes**. If the policy has no other settings, remove the policy with **Remove policy** on the **Permission policies** page. Until November 10, 2026, the **Chat** and **Cowork** switches then apply to the group again.
197197
198198Turning on the **Opt into the new Chat and Cowork unified view** switch sets the [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) key, and turning it off removes the key. The **Chat and Cowork unified view** switch saves the value `standard` when it is on and `off` when it is off. With the value `off`, the **Opt into the new Chat and Cowork unified view** switch stays on, and Chat and Cowork are off entirely. Users' apps pick up the change as described under [Configuration updates](#configuration-updates).
199
200### Keep Chat and Cowork off
201
202Where [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) is on by default, Cowork is on even where the **Cowork** switch is off for your organization or in a group's policy. To keep Cowork off, turn off the **Chat and Cowork unified view** switch. That turns Chat off too and leaves users with Code only. Make the change before November 10, 2026, so that Cowork doesn't come on first. Users' apps pick up the change as described under [Configuration updates](#configuration-updates).
203
204Devices that [use a managed profile's configuration](#devices-with-a-managed-profile) don't follow the console. To keep Cowork off on those devices, see [Keep Cowork off](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#keep-cowork-off).
205
206The **Chat and Cowork unified view** switch can't be turned off while the **Code** switch in the same list is off, so these steps turn on **Code** first.
207
208* **For your whole organization**: open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. Under **Allowed surfaces**, turn on the **Code** switch if it is off, then the **Opt into the new Chat and Cowork unified view** switch if it is off. If the **Chat and Cowork unified view** switch under it is on, turn it off. Click **Save changes**. Chat and Cowork are then off for each group unless the group's policy turns on the **Chat and Cowork unified view** switch. That includes a group whose policy turns Chat or Cowork on.
209* **For a group**: open **Organization settings**, go to the **Permission policies** page under **People**, and open the group's policy. In the policy's **Capabilities** section, turn on the **Code** switch if it is off, then the **Opt into the new Chat and Cowork unified view** switch if it is off. If the **Chat and Cowork unified view** switch under it is on, turn it off. Click **Save changes**.
210
211For a member of several groups, the highest-ranked of their policies that sets the **Opt into the new Chat and Cowork unified view** or **Chat and Cowork unified view** switch decides.
199212
200213### Plugin marketplaces
201214
third-party/claude-desktop/bedrock Changed · +1 / -5 lines
from line 206
206206
207207Since 1.2581.0
208208
209**Bedrock base URL.** For VPC endpoints or gateway proxies. Host origin only.
209**Bedrock base URL.** For VPC endpoints or gateway proxies. Enter https\:// and the host, with no path.
210210
211211***
212212
from line 217
217217**Bedrock service tier.** Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand.
218218
219219One of: `flex`, `priority`
220
221> **More detail**
222>
223> Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key.
224220
225221***
226222
third-party/claude-desktop/bootstrap Changed · +16 / -10 lines
from line 383
383383
384384Since 1.10628.0
385385
386**Use bootstrap config.** Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch.
386**Use bootstrap config.** Fetch and apply settings from the bootstrap config URL at launch. Turn off to keep the URL saved but skip the fetch.
387387
388388***
389389
from line 407
407407
408408Since 1.10628.0
409409
410**Bootstrap OIDC parameters.** When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE).
410**Bootstrap OIDC parameters.** Your organization’s OpenID Connect identity provider. The user’s token from a browser sign-in is sent as Bearer to the bootstrap server.
411411
412412> **More detail**
413413>
414> Set this to use a separate identity provider (Microsoft Entra ID, Okta, Ping, or any compliant OIDC provider) for the bootstrap sign-in. The app runs an authorization-code-with-PKCE flow in the system browser. Omit to use device-code mode against the bootstrap server's own origin.
414> When unset, the bootstrap sign-in uses a device code on the bootstrap server's own origin.
415415>
416> This is an **object-typed key** — in an MDM profile it is a single JSON-string value, not separate keys with dotted names like `bootstrapOidc.clientId`. Writing the sub-fields as separate registry values causes the app to silently fall through to device-code mode.
416> In an MDM profile, write this key as one JSON string. Separate values such as `bootstrapOidc.clientId` do not work: the app silently uses the device-code sign-in instead.
417417
418418> **Child attributes (8)**
419419>
from line 449
449449>
450450> **additionalRedirectReferrerHosts** `string`
451451>
452> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
452> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
453453>
454454> > **More detail**
455455> >
456> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
456> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
457457
458458***
459459
from line 469
469469
470470> **More detail**
471471>
472> Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead.
472> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch.
473>
474> These headers, and those of `bootstrapHeadersHelper`, also go to a plugin marketplace on this server's own origin, if its `allowedPluginMarketplaces` entry sets `credentialKind: "inferenceCredential"`.
475>
476> Header values are masked in diagnostics and telemetry.
473477
474478***
475479
from line 489
485489
486490> **More detail**
487491>
488> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`.
492> Example output: `{"Authorization": "Bearer …"}`. The app runs the helper script with no arguments and reuses its output for a few minutes.
493>
494> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs, its token takes priority for the `Authorization` header.
489495
490496***
491497
from line 503
497503
498504Since 1.26832.0
499505
500**Trust bootstrap-delivered settings.** Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers.
506**Trust bootstrap-delivered settings.** Skip the per-user consent prompt for sign-in settings, inference endpoints, helper scripts, and connectors the bootstrap server delivers.
501507
502508***
503509
third-party/claude-desktop/chat Changed · +8 / -8 lines
from line 4
44
55> [!NOTE]
66>
7> When [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) is on, a message sent from the home screen starts a Cowork session where Cowork is on and the device can run it. From November 10, 2026, unless an [exception](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude) applies, Unified Claude is on by default.
7> When [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) is on, a message sent from the home screen starts a Cowork session on a device that can run Cowork. From November 10, 2026, Unified Claude is [on by default](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude). Cowork is then on too, even where you turned Cowork off. To keep Cowork off, see [Keep Cowork off](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#keep-cowork-off).
88
9Chat in Claude Desktop on third-party (3P) is a conversational surface for quick questions and drafting. Unlike [Cowork](https://claude.com/docs/cowork/overview.md) and [Code](https://claude.com/docs/third-party/claude-desktop/code.md), which run agentic sessions with access to folders you grant and a code-execution environment, a Chat conversation runs with a deliberately small tool surface: it can search and fetch the web under your admin configuration, read files attached to the conversation, read and update the project's memory and read the files in the project's folders when the conversation is inside a project, write files into a scratch space of its own, and use skills from the plugins you provision, and nothing else on the machine. While Unified Claude is off, Chat is off by default and is enabled with a single configuration key.
9Chat in Claude Desktop on third-party (3P) is a conversational surface for quick questions and drafting. Unlike [Cowork](https://claude.com/docs/cowork/overview.md) and [Code](https://claude.com/docs/third-party/claude-desktop/code.md), which run agentic sessions with access to folders you grant and a code-execution environment, a Chat conversation runs with a deliberately small tool surface: it can search and fetch the web under your admin configuration, read files attached to the conversation, read and update the project's memory and read the files in the project's folders when the conversation is inside a project, write files into a scratch space of its own, and use skills from the plugins you provision, and nothing else on the machine. While `desktopHome` is unset and Unified Claude is off, Chat is off by default and is enabled with a single configuration key.
1010
1111Chat conversations run against your configured inference provider, and their history is stored on the user's device. See [User identity and local data](https://claude.com/docs/third-party/claude-desktop/data-storage.md#chat-conversations) for exactly what is written where and what can leave the device.
1212
from line 77
7777> By default, commands in the sandbox run without an approval prompt. A command can upload anything the sandbox can read to a listed host, and can run what it downloads from one. [Web fetch](https://claude.com/docs/third-party/claude-desktop/web-tools.md#web-fetch) in Chat uses the same list, so a host you list for web fetch is also open to sandbox commands. With `"*"` in the list, network filtering in the sandbox is off, so commands can reach any host.
7878>
7979> * **To have Claude ask before each command**, set `"Bash"` to `"ask"` in [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy). That policy also applies to Cowork and Code sessions.
80> * **To keep web fetch but turn off sandbox commands**, set [`chatAdvancedFileAnalysisEnabled`](#configuration) to `false`. While Unified Claude and Cowork are on, Claude Desktop ignores that key, so add `"Bash"` to [`disabledBuiltinTools`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledbuiltintools) instead. With that entry, Claude also can't run commands with its shell tool in Cowork or Code sessions, including the Cowork sessions that users start from the [home screen](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude).
80> * **To keep web fetch but turn off sandbox commands**, set [`chatAdvancedFileAnalysisEnabled`](#configuration) to `false`. While Unified Claude is on, Claude Desktop ignores that key, so add `"Bash"` to [`disabledBuiltinTools`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledbuiltintools) instead. With that entry, Claude also can't run commands with its shell tool in Cowork or Code sessions, including the Cowork sessions that users start from the [home screen](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#what-users-see-with-unified-claude).
8181
8282> [!NOTE]
8383>
from line 87
8787
8888| Key | Default | Effect |
8989| - | - | - |
90| [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled) | off | Makes Chat available. While Unified Claude is off, Chat is opt-in: it appears in the app only when this key is explicitly `true`. |
90| [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled) | off | Makes Chat available. While `desktopHome` is unset and Unified Claude is off, Chat is opt-in: it appears in the app only when this key is explicitly `true`. |
9191| [`chatAdvancedFileAnalysisEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled) | off | Allows code execution in the sandbox described under [Advanced file analysis](#advanced-file-analysis), on attached files and, inside a project, on files in the project's folders. Has no effect unless Chat is enabled. |
9292
93While the `desktopHome` key for [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#how-unified-claude-interacts-with-chat-and-cowork-settings) has a value, Claude Desktop ignores `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled`.
93Claude Desktop ignores `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled` while the `desktopHome` key for [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#how-unified-claude-interacts-with-chat-and-cowork-settings) has a value, including `off`. It also ignores them while Unified Claude is [on by default](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude). With the value `off`, Chat and Cowork are off.
9494
95While Unified Claude is off, the layout follows `chatTabEnabled`. When the key is `true`, Claude Desktop presents Chat and Cowork together as **Home** in its sidebar, next to **Code**. From Home, the user chooses **Chat** or **Cowork** in the message box, and the sidebar lists chats and tasks together. When the key is unset or `false`, the sidebar shows **Cowork** in place of Home and the message box offers no choice. If [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled) is `false` while Chat is enabled, the message box offers Chat only.
95While `desktopHome` is unset and Unified Claude is off, the layout follows `chatTabEnabled`. When the key is `true`, Claude Desktop presents Chat and Cowork together as **Home** in its sidebar, next to **Code**. From Home, the user chooses **Chat** or **Cowork** in the message box, and the sidebar lists chats and tasks together. When the key is unset or `false`, the sidebar shows **Cowork** in place of Home and the message box offers no choice. If [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled) is `false` while Chat is enabled, the message box offers Chat only.
9696
9797> [!NOTE]
9898>
9999> This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat** (when enabled), **Cowork**, and **Code** as separate tabs, controlled by the same keys.
100100
101While Unified Claude is off, enforcement of `chatTabEnabled` happens in the app's main process: when the key is unset or `false`, Chat does not appear in the app, and the app additionally refuses to start or continue a Chat conversation, including conversations created before an admin turned the key off.
101While `desktopHome` is unset and Unified Claude is off, the app's main process enforces `chatTabEnabled`. When the key is unset or `false`, Chat doesn't appear in the app. The app also refuses to start or continue a Chat conversation, including conversations created before an admin turned the key off.
102102
103The rule that at least one surface must stay enabled counts Chat only when `chatTabEnabled` is explicitly `true`: a configuration that disables Cowork and Code without enabling Chat re-enables Cowork with a validation warning, rather than leaving users with an empty app.
103While `desktopHome` is unset and Unified Claude is off, at least one surface must stay on, and Chat counts toward that only when `chatTabEnabled` is explicitly `true`. Under that rule, if a configuration turns off Cowork and Code without turning on Chat, Claude Desktop turns Cowork back on, with a validation warning.
104104
105105## Where Chat data lives
106106
third-party/claude-desktop/configuration Changed · +888 / -849 lines
#### `skillScanningEnabled` #### `projectsEnabled` ### `sessionStatusLine`
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.
third-party/claude-desktop/configuration-changelog Changed · +32 / -1 lines
from line 4
44
55Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration).
66
7**v4.4212.0**
8
92026-10-29
10
11| MDM key | Type | Description |
12| - | - | - |
13| [`skillScanningEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#skillscanningenabled) · Beta | `boolean` | Scan user-created skills |
14| [`projectsEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#projectsenabled) | `boolean` | Allow projects |
15| [`sessionStatusLine`](https://claude.com/docs/third-party/claude-desktop/configuration#sessionstatusline) | `object` | Status line |
16
17**JSON (e.g. for non-MDM users or Bootstrap):**
18
19```json theme={null}
20{
21 "workspace": {
22 "skillScanningEnabled": "<boolean>",
23 "projectsEnabled": "<boolean>"
24 },
25 "appearance": {
26 "sessionStatusLine": {
27 "command": "<string>"
28 }
29 }
30}
31```
32
33**Changed:**
34
35* **Breaking:** `desktopHome`: at launches after 12:00 PM PT (20:00 UTC) on November 10, 2026, an unset key reads as `standard`: Unified Claude opens with Cowork on, even where `coworkTabEnabled` is `false`. In 4.29, an unset key did so only where Cowork was on. `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` have no effect under `standard`. To keep Cowork off, set `desktopHome` to `off`, which also turns Chat off and leaves only Code. Where `isClaudeCodeForDesktopEnabled` is also `false`, the app then has nothing to open.
36* `sshClientPath`: on Windows, a value may begin with `%LOCALAPPDATA%\`, which the app reads as the signed-in user's own local app data folder. It counts only when machine-wide policy (HKLM) itself sets it as a plain string (REG\_SZ), with `sshTransport: system-openssh` set by an administrator, and only while Claude does not run with administrator rights. Otherwise SSH sessions do not connect. Where a configuration server is in use, it must repeat this value and `sshTransport`, or the device's values are not used. The user can replace a program in that folder, so with such a value that user can get around this key and `sshHostAllowlist`, and the program can see SSH passwords.
37
738**v4.29.0**
839
9402026-10-27
from line 55
2455
2556**Changed:**
2657
27* `desktopHome`: from November 10, 2026 (12:00 PM PT, by the device's clock), an unset key opens Unified Claude at the app's next launch. With Cowork on, Chat and Advanced file analysis come on too, even if `chatTabEnabled` or `chatAdvancedFileAnalysisEnabled` is `false`. A deployment with Cowork on that sets `chatSessionRetentionDays`, and does not set `coworkSessionRetentionDays` to the same number of days, keeps its current view. Earlier releases are unchanged.
58* `desktopHome`: from November 10, 2026 (12:00 PM PT, by the device's clock), an unset key opens Unified Claude at the app's next launch. With Cowork on, it reads as `standard`, under which `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` have no effect. A deployment with Cowork on that sets `chatSessionRetentionDays`, and does not set `coworkSessionRetentionDays` to the same number of days, keeps its current view. Earlier releases are unchanged.
2859* `inferenceModels`: an entry accepts `behavesAs`, the Claude model behind a Model ID that Claude Desktop cannot identify, such as a gateway alias. The ID then gets that model's effort levels and limits. Once any entry sets it, sessions that Claude Desktop starts no longer read a person's own `modelPicker` setting from Claude Code's settings.
2960* `managedMcpServers`: a remote entry accepts `defaultState`. Set it to `"off"` and the connector stays out of each person's sessions until they turn it on under Connectors in the + menu. Adding `"off"` to a connector in use turns it off for everyone who has not switched it on.
3061* `managedMcpServers`: a remote entry's `oauth` accepts `omitResource`. Set it to `true` when the identity provider rejects the OAuth `resource` parameter (Microsoft Entra ID: AADSTS9010010). It needs the entry's client ID, a scope that names the API, and exactly one sign-in server: a tenant ID, one authorization server, or an authorization URL and token URL. Otherwise the server is not loaded.
third-party/claude-desktop/foundry Changed · +6 / -6 lines
from line 139
139139
140140> **More detail**
141141>
142> Set this only when the app reaches Foundry through a gateway or proxy you run, such as Azure API Management. Requests go to `<value>/v1/messages` instead of `https://<resource>.services.ai.azure.com/anthropic/v1/messages`, carrying the same credential and headers the app would send to Foundry: each user's Entra ID token for the Azure Cognitive Services audience as `Authorization: Bearer` with Entra sign-in, otherwise the API key or the credential helper's output. Claude Code sessions receive the value as `ANTHROPIC_FOUNDRY_BASE_URL`, so use the same value you would give Claude Code in a terminal. `inferenceFoundryResource` is still required and should name the resource behind the gateway; the app sends nothing to the resource directly while this is set. Must be https, or http to a proxy at a loopback address on the device itself (127.0.0.1, localhost or \[::1]).
142> Point it only at a gateway or proxy that you run. Requests carry the credential that the app would send to Foundry: the user's Entra ID token, the API key or the helper script's output.
143>
144> Use the value that you would give Claude Code as `ANTHROPIC_FOUNDRY_BASE_URL`. `inferenceFoundryResource` is still required and should name the resource behind the gateway.
143145
144146***
145147
from line 187
185187
186188> **More detail**
187189>
188> * **`device-code`** (default) — shows a code to enter at microsoft.com/devicelogin. The app registration must have **Allow public client flows** enabled.
189> * **`browser`** — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. The app registration must include `http://127.0.0.1/callback` under the **Mobile and desktop applications** platform (Entra ignores the loopback port, but not the path). Works with **Allow public client flows** disabled, and is unaffected by Conditional Access policies that block device-code authentication.
190> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS), so it can satisfy Conditional Access policies that require a compliant/managed device or token protection. The app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
191>
192> App versions that predate this key always use device code; versions that predate the broker option treat `broker` as unset and use device code.
190> * **`device-code`:** shows a code to enter at microsoft.com/devicelogin. The app registration must have **Allow public client flows** enabled.
191> * **`browser`:** register `http://127.0.0.1/callback` under **Mobile and desktop applications**. It works with **Allow public client flows** disabled. Conditional Access policies that block device-code sign-in do not affect it.
192> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection. Add the redirect URIs listed under [Register the Entra ID application](https://claude.com/docs/third-party/claude-desktop/entra-broker.md#register-the-entra-id-application).
193193
194194***
195195
third-party/claude-desktop/gateway Changed · +71 / -65 lines
from line 222
222222
223223> **More detail**
224224>
225> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration.
226> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceGatewayOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
225> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
226> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
227227>
228> Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes`, and forwards it to the customer's own gateway; both endpoints of that trust relationship are inside the customer's control. A desktop that has the `external-idp` kind reads this key, together with `inferenceGatewayOidc`, as that kind's sign-in flow; it stays readable.
228> `broker` needs Microsoft Entra ID, with the `issuer` in `inferenceGatewayOidc` set to `https://login.microsoftonline.com/{tenant-id}/v2.0`. Add the redirect URIs listed under [Register the Entra ID application](https://claude.com/docs/third-party/claude-desktop/entra-broker.md#register-the-entra-id-application).
229229
230230***
231231
from line 247
247247
248248> **More detail**
249249>
250> **External IdP mode.** The app discovers `<issuer>/.well-known/openid-configuration`, runs an OIDC authorization-code-with-PKCE sign-in in the system browser with `clientId`, and sends the resulting token as `Authorization: Bearer` on every inference request. Leave this unset for a gateway that hosts its own RFC 8414 metadata at `<baseUrl>/.well-known/oauth-authorization-server`. A desktop that has the `external-idp` kind reads this block as that kind's identity-provider key; it stays readable, so a fleet keeps this spelling until every desktop is on such a release.
250> Used with `inferenceCredentialKind` set to `interactive`. Leave it unset for a gateway that runs its own sign-in and serves `<baseUrl>/.well-known/oauth-authorization-server`.
251251>
252> **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the gateway validates signature, `iss`, and `aud` (the `clientId` configured here). `access_token` sends the OAuth access token, for gateways that validate as a resource server (Portkey, Kong, Envoy JWT filter, AWS API Gateway authorizers); `scopes` must then name the gateway's registered API scope. Either way the gateway must check `aud`, not just signature and issuer, or it accepts any token from your tenant.
252> Your gateway must check the token's audience (`aud`). Otherwise it accepts any token from your tenant.
253253>
254> **IdP setup.** The callback is `http://127.0.0.1:<port>/callback` by default (`http://localhost:<port>/callback` with `redirectHost: "localhost"`); register exactly the one you use and include `/callback`. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI of `http://127.0.0.1/callback` (any port; omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the gateway API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with the exact URI `http://127.0.0.1:<port>/callback` and that port in `redirectPort`.
255>
256> **Refresh.** With `offline_access` the app renews the token silently and prompts a browser sign-in only when refresh fails. Google never returns an `id_token` on refresh, so a Google Workspace-backed gateway in `id_token` mode re-prompts about hourly; `access_token` mode is unaffected.
254> Register the redirect URI given under `inferenceGatewayOidcAuthFlow`.
257255
258256> **Child attributes (11)**
259257>
from line 279
281279>
282280> > **More detail**
283281> >
284> > In **access-token** mode the token's audience must be your gateway or proxy. On IdPs where the requested scopes decide the audience (**Entra ID**), include its API resource scope in `scopes` — `api://<gateway-app-id>/.default`, or a named delegated scope you exposed via *Expose an API*. With only the standard OIDC scopes (`openid profile email offline_access`) Entra returns a v1.0 Microsoft Graph token whose issuer (`https://sts.windows.net/<tenant>/`) doesn't match the v2.0 issuer configured here, so a gateway that validates `iss` rejects it. On IdPs that set the access-token audience out-of-band (Keycloak audience mapper, Auth0 default audience, Okta custom authorization server), a resource scope in `scopes` isn't required — the audience comes from the IdP-side configuration.
282> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
283> >
284> > With Entra ID the scopes decide the audience, so add the gateway's API scope to `scopes`, such as `api://<gateway-app-id>/.default`.
285285>
286286> **scopes** `string`
287287>
288> Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below.
288> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
289289>
290> > **More detail**
291> >
292> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
293>
290294> **appendOfflineAccess** `boolean` (default: true)
291295>
292> Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh.
296> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
293297>
294298> > **More detail**
295299> >
296> > Turn off only if your authorization server rejects `offline_access` as an unknown scope; include the server’s own refresh-token scope in **Scopes** instead.
300> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
297301>
298302> **resource** `string`
299303>
300> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID.
304> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
301305>
302306> > **More detail**
303307> >
304> > Set this only for an IdP that implements RFC 8707 resource indicators. The app then sends `resource=<value>` on the authorization, token and refresh requests, so the access token the IdP issues is audience-restricted to the gateway or proxy rather than to the IdP's own APIs. Use it with `bearerTokenType: access_token`; in `id_token` mode the ID token's audience is always `clientId`. Ignored with the OS-broker sign-in flow (the sign-in flow key set to `broker`), which is Entra-only.
308> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
305309> >
306> > **Microsoft Entra ID:** leave unset — the v2.0 endpoint rejects `resource`; request the API scope in `scopes` instead (`api://<gateway-app-id>/.default`). **AD FS:** enter one of the relying-party trust's identifiers, spelled as it is registered there. A value with no scheme (a host name with or without a port or path, a single name, or a GUID; `name:digits` also reads as a host name with a port) is sent as `https://<value>`; an identifier with a scheme of its own (`urn:…`, or an organization-defined one such as `VENDOR:URI:…`) is sent exactly as written. A trust whose only identifier is a bare name or GUID will not match, because those are sent as `https://<value>`: add an `https://…` or `urn:…` identifier to the trust and enter that one here. With any other identity provider, use an absolute URI without a fragment (RFC 8707 — the IdP rejects one as `invalid_target`). Changing it signs users in again.
310> > For AD FS, enter one of the relying-party trust's identifiers. A value with no scheme is sent as `https://<value>`, so a plain name or GUID does not match. Add an `https://…` or `urn:…` identifier to the trust and enter that.
307311>
308312> **redirectPort** `integer`
309313>
from line 321
317321>
318322> **additionalRedirectReferrerHosts** `string`
319323>
320> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
324> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
321325>
322326> > **More detail**
323327> >
324> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
328> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
325329
326330***
327331
from line 339
335339
336340> **More detail**
337341>
338> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceIdpOidc` for redirect-URI registration.
339> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceIdpOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
342> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
343> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
340344>
341> Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes` and forwards it to the customer's own gateway or proxy; both endpoints of that trust relationship are inside the customer's control.
345> `broker` needs Microsoft Entra ID, with the `issuer` in `inferenceIdpOidc` set to `https://login.microsoftonline.com/{tenant-id}/v2.0`. Add the redirect URIs listed under [Register the Entra ID application](https://claude.com/docs/third-party/claude-desktop/entra-broker.md#register-the-entra-id-application).
342346
343347***
344348
from line 358
354358
355359> **More detail**
356360>
357> Used with `inferenceCredentialKind: "external-idp"`. The app discovers `<issuer>/.well-known/openid-configuration`, runs an OIDC authorization-code (PKCE) sign-in in the browser with `clientId` (or through the OS broker, see `inferenceIdpAuthFlow`) and sends the token as `Authorization: Bearer` on every inference request: to `inferenceGatewayBaseUrl` on the gateway provider, or on Bedrock to `inferenceBedrockBaseUrl`, which is then required: only a proxy that validates the token accepts it, never Amazon Bedrock itself (to sign in straight to Bedrock use `interactive`, AWS IAM Identity Center). On Bedrock this kind has no model discovery: list the models in `inferenceModels`.
361> Used when `inferenceCredentialKind` is `external-idp`. Register the redirect URI given under `inferenceIdpAuthFlow` with your identity provider.
358362>
359> **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the receiver validates signature, `iss` and `aud` (the `clientId` here). `access_token` sends the OAuth access token, for gateways and proxies that validate as an OAuth resource server; `scopes` must then name the registered API scope. Either way the receiver must check `aud`, or it accepts any token from your tenant.
363> Your gateway or proxy must check the token's audience (`aud`). Otherwise it accepts any token from your tenant.
360364>
361> **IdP setup.** The callback is `http://127.0.0.1:<port>/callback` (`localhost` with `redirectHost: "localhost"`); register exactly that. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI `http://127.0.0.1/callback` (omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with `http://127.0.0.1:<port>/callback` and that port in `redirectPort`.
362>
363> **Refresh.** With `offline_access` the app renews the token silently and asks for a browser sign-in only when refresh fails (Google returns no `id_token` on refresh, so `id_token` mode there re-prompts about hourly).
364>
365> **Older names.** Gateway configurations written before this key use `inferenceGatewayOidc` / `inferenceGatewayOidcAuthFlow` with the `interactive` kind; they stay readable and mean the same sign-in.
365> On Bedrock, set `inferenceBedrockBaseUrl` to a proxy that checks the token, because Amazon Bedrock itself does not accept it. Also list your models in `inferenceModels`.
366366
367367> **Child attributes (11)**
368368>
from line 390
390390>
391391> > **More detail**
392392> >
393> > In **access-token** mode the token's audience must be your gateway or proxy. On IdPs where the requested scopes decide the audience (**Entra ID**), include its API resource scope in `scopes` — `api://<gateway-app-id>/.default`, or a named delegated scope you exposed via *Expose an API*. With only the standard OIDC scopes (`openid profile email offline_access`) Entra returns a v1.0 Microsoft Graph token whose issuer (`https://sts.windows.net/<tenant>/`) doesn't match the v2.0 issuer configured here, so a gateway that validates `iss` rejects it. On IdPs that set the access-token audience out-of-band (Keycloak audience mapper, Auth0 default audience, Okta custom authorization server), a resource scope in `scopes` isn't required — the audience comes from the IdP-side configuration.
393> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
394> >
395> > With Entra ID the scopes decide the audience, so add the gateway's API scope to `scopes`, such as `api://<gateway-app-id>/.default`.
394396>
395397> **scopes** `string`
396398>
397> Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below.
399> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
398400>
401> > **More detail**
402> >
403> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
404>
399405> **appendOfflineAccess** `boolean` (default: true)
400406>
401> Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh.
407> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
402408>
403409> > **More detail**
404410> >
405> > Turn off only if your authorization server rejects `offline_access` as an unknown scope; include the server’s own refresh-token scope in **Scopes** instead.
411> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
406412>
407413> **resource** `string`
408414>
409> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID.
415> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
410416>
411417> > **More detail**
412418> >
413> > Set this only for an IdP that implements RFC 8707 resource indicators. The app then sends `resource=<value>` on the authorization, token and refresh requests, so the access token the IdP issues is audience-restricted to the gateway or proxy rather than to the IdP's own APIs. Use it with `bearerTokenType: access_token`; in `id_token` mode the ID token's audience is always `clientId`. Ignored with the OS-broker sign-in flow (the sign-in flow key set to `broker`), which is Entra-only.
419> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
414420> >
415> > **Microsoft Entra ID:** leave unset — the v2.0 endpoint rejects `resource`; request the API scope in `scopes` instead (`api://<gateway-app-id>/.default`). **AD FS:** enter one of the relying-party trust's identifiers, spelled as it is registered there. A value with no scheme (a host name with or without a port or path, a single name, or a GUID; `name:digits` also reads as a host name with a port) is sent as `https://<value>`; an identifier with a scheme of its own (`urn:…`, or an organization-defined one such as `VENDOR:URI:…`) is sent exactly as written. A trust whose only identifier is a bare name or GUID will not match, because those are sent as `https://<value>`: add an `https://…` or `urn:…` identifier to the trust and enter that one here. With any other identity provider, use an absolute URI without a fragment (RFC 8707 — the IdP rejects one as `invalid_target`). Changing it signs users in again.
421> > For AD FS, enter one of the relying-party trust's identifiers. A value with no scheme is sent as `https://<value>`, so a plain name or GUID does not match. Add an `https://…` or `urn:…` identifier to the trust and enter that.
416422>
417423> **redirectPort** `integer`
418424>
from line 432
426432>
427433> **additionalRedirectReferrerHosts** `string`
428434>
429> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
435> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
430436>
431437> > **More detail**
432438> >
433> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
439> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
434440
435441***
436442
from line 448
442448
443449> **More detail**
444450>
445> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults.
451> With pings arriving (SSE `ping` events or `:` comment lines), sessions accept at least about five minutes of them, then wait this many seconds more. With no pings, a silent response still fails after about 5 minutes whatever this value, so make the gateway send them.
446452>
447> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies.
453> While this key is set, it takes priority over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's managed settings for sessions the app starts.
448454
449455***
450456
third-party/claude-desktop/mantle Changed · +1 / -5 lines
from line 65
6565
6666Since 1.2581.0
6767
68**Bedrock base URL.** For VPC endpoints or gateway proxies. Host origin only.
68**Bedrock base URL.** For VPC endpoints or gateway proxies. Enter https\:// and the host, with no path.
6969
7070***
7171
from line 76
7676**Bedrock service tier.** Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand.
7777
7878One of: `flex`, `priority`
79
80> **More detail**
81>
82> Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key.
8379
8480***
8581
third-party/claude-desktop/unified-claude Changed · +23 / -11 lines
## Keep Cowork off
from line 4
44
55> [!NOTE]
66>
7> Unified Claude is in beta. It is opt-in until November 10, 2026. From that date, unless an [exception](#enabling-unified-claude) applies, it is on by default. New [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md) organizations start with Unified Claude on.
7> Unified Claude is in beta. It is opt-in until November 10, 2026. From that date, Unified Claude is [on by default](#enabling-unified-claude). Cowork is then on too, even where you turned Cowork off. To keep Cowork off, see [Keep Cowork off](#keep-cowork-off). New [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md) organizations start with Unified Claude on.
88
99Unified Claude combines Chat and Cowork into one experience in Claude Desktop 3P. Users get a single Claude interface for both quick chats and longer agentic tasks. [Code](https://claude.com/docs/third-party/claude-desktop/code.md) stays separate.
1010
11Where Cowork is on, Unified Claude contains the same capabilities as Cowork on Desktop 3P today, including bash execution, subagents, and scheduled tasks. The Chat experience is going away, but you can restrict specific Cowork capabilities in Unified Claude through your other settings options and tool policies.
11Unified Claude contains the same capabilities as Cowork on Desktop 3P today, including bash execution, subagents, and scheduled tasks. The Chat experience is going away, but you can restrict specific Cowork capabilities in Unified Claude through your other settings options and tool policies.
1212
1313Unified Claude runs without Cowork capabilities if the user's machine cannot launch the VM. If so, the application will revert to non-VM capabilities under Unified Claude.
1414
1515## What users see with Unified Claude
1616
17With Unified Claude on, users type into the message box on the home screen without first choosing between Chat and Cowork. Where Cowork is on and the device can run it, each message sent from the home screen starts a Cowork session. On a device that can't run Cowork's virtual machine, the message starts a Chat conversation instead.
17With Unified Claude on, users type into the message box on the home screen without first choosing between Chat and Cowork. On a device that can run Cowork, each message sent from the home screen starts a Cowork session. On a device that can't run Cowork's virtual machine, the message starts a Chat conversation instead.
1818
1919A Cowork session started this way has Cowork-level tools and follows your Cowork settings. For example, Claude can create and change files in folders the user attaches, and create scheduled tasks.
2020
from line 22
2222
2323## Enabling Unified Claude
2424
25Unified Claude is opt-in until November 10, 2026. When Claude Desktop starts after 12:00 PM Pacific Time on that date, Unified Claude is on by default where [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) is unset, except in cases such as these:
25Unified Claude is opt-in until November 10, 2026. When a current version of Claude Desktop starts after 12:00 PM Pacific Time on that date, it reads an unset [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) as `standard`, the value that turns on Unified Claude. Unified Claude is then on by default.
2626
27* **A Chat retention period that differs from Cowork's**: where Cowork is on, [`chatSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#chatsessionretentiondays) is set, and [`coworkSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) isn't set to the same number of days, Unified Claude is off until the two match or you set `desktopHome`. A later change that creates this mismatch turns Unified Claude off again.
28* **Chat, Cowork, and Code all off**: Claude Desktop keeps turning one of them back on, as described under [Chat configuration](https://claude.com/docs/third-party/claude-desktop/chat.md#configuration)
29* **Earlier app versions**: the default comes with an app update, so a device switches only after it installs that update
27> [!WARNING]
28>
29> The default applies even where [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled), [`chatAdvancedFileAnalysisEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled), or [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled) is `false`. Cowork is on even where you turned it off. To keep Cowork off, see [Keep Cowork off](#keep-cowork-off).
3030
31Where Cowork is on, the default turns on Chat and advanced file analysis, even where [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled) or [`chatAdvancedFileAnalysisEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled) is `false`. To turn off sandbox commands, see [Sandbox network access](https://claude.com/docs/third-party/claude-desktop/chat.md#sandbox-network-access).
31If you use [`chatSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#chatsessionretentiondays), set [`coworkSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) as well, before November 10, 2026, or earlier if you turn on Unified Claude yourself. `coworkSessionRetentionDays` covers new conversations that are Cowork sessions, along with users' other Cowork tasks, as described under [Automatic deletion of idle sessions](https://claude.com/docs/third-party/claude-desktop/data-storage.md#automatic-deletion-of-idle-sessions).
3232
3333To turn on Unified Claude yourself, use the setting for your deployment:
3434
3535* **Enterprise Admin Console**: Go to Capabilities and toggle on "Opt into the new Chat and Cowork unified view."
36* **MDM or a bootstrap server**: For MDM and bootstrap deployments, the [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) key controls Unified Claude. Create and set `desktopHome` to `standard` in your [MDM profile](https://claude.com/docs/third-party/claude-desktop/mdm.md) or [bootstrap response](https://claude.com/docs/third-party/claude-desktop/bootstrap.md). Claude Desktop reads a value it doesn't recognize as `off`. Where the default doesn't apply, removing the key turns Unified Claude off.
36* **MDM or a bootstrap server**: For MDM and bootstrap deployments, the [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) key controls Unified Claude. Create and set `desktopHome` to `standard` in your [MDM profile](https://claude.com/docs/third-party/claude-desktop/mdm.md) or [bootstrap response](https://claude.com/docs/third-party/claude-desktop/bootstrap.md). Claude Desktop reads a value it doesn't recognize as `off`. Until November 10, 2026, removing the key turns Unified Claude off.
3737
38If you use `chatSessionRetentionDays`, set `coworkSessionRetentionDays` as well before you turn on Unified Claude. `coworkSessionRetentionDays` covers new conversations that are Cowork sessions, along with users' other Cowork tasks, as described under [Automatic deletion of idle sessions](https://claude.com/docs/third-party/claude-desktop/data-storage.md#automatic-deletion-of-idle-sessions).
38## Keep Cowork off
3939
40Where Unified Claude is [on by default](#enabling-unified-claude), Cowork is on even if you turned it off with [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled) or with the **Cowork** switch in the Enterprise Admin Console. To keep Cowork off, turn off Chat and Cowork where each device gets its settings:
41
42* **From the Enterprise Admin Console**: follow the steps under [Keep Chat and Cowork off](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-chat-and-cowork-off) for your organization or for a group. Devices that [use an MDM profile's configuration](https://claude.com/docs/third-party/claude-desktop/admin-console.md#devices-with-a-managed-profile) don't follow the console, so make the change for them in the profile, or on its bootstrap server if it has one.
43* **From a bootstrap server or a Claude apps gateway**: set [`desktopHome`](https://claude.com/docs/third-party/claude-desktop/configuration#desktophome) to `off` in your [bootstrap response](https://claude.com/docs/third-party/claude-desktop/bootstrap.md), or in the `desktop` block of your gateway's `managed` policies, as described under [Claude Desktop overlay](https://code.claude.com/docs/en/claude-apps-gateway-config#claude-desktop-overlay). Once a device has fetched its settings, it [ignores `desktopHome` in its MDM profile](https://claude.com/docs/third-party/claude-desktop/configuration-format#which-configuration-source-applies-on-a-device).
44* **From an MDM profile alone**: set `desktopHome` to `off` in the [MDM profile](https://claude.com/docs/third-party/claude-desktop/mdm.md)
45
46Turning off the console's **Chat and Cowork unified view** switch or setting `desktopHome` to `off` turns Chat off too, even where `chatTabEnabled` is `true`. That leaves users with [Code](https://claude.com/docs/third-party/claude-desktop/code.md) only. If Code is off, set [`isClaudeCodeForDesktopEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#isclaudecodefordesktopenabled) to `true` in the same change. With either setting and Code off, Claude Desktop has nothing to open, and it doesn't turn Cowork back on.
47
48Users lose Chat as soon as their devices apply the change, even before November 10, 2026. Make the change before that date so that Cowork doesn't come on first.
49
50To leave Cowork on and limit what Claude can do in it, use settings such as [`disabledBuiltinTools`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledbuiltintools), [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy), [`allowedWorkspaceFolders`](https://claude.com/docs/third-party/claude-desktop/configuration#allowedworkspacefolders), and [`scheduledTasksEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#scheduledtasksenabled). For example, to stop Claude from running shell commands, add `"Bash"` to `disabledBuiltinTools`. That entry applies in Code sessions too, as described under [Sandbox network access](https://claude.com/docs/third-party/claude-desktop/chat.md#sandbox-network-access).
51
4052## How Unified Claude interacts with Chat and Cowork settings
4153
42When your configuration sets `desktopHome`, Claude Desktop ignores [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled), [`chatAdvancedFileAnalysisEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled), and [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled). New conversations that are Cowork sessions follow the Cowork retention period. The Chat retention period still covers Chat conversations, such as earlier chats.
54Claude Desktop ignores [`chatTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chattabenabled), [`chatAdvancedFileAnalysisEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled), and [`coworkTabEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#coworktabenabled) when your configuration sets `desktopHome`, whether to `standard` or to `off`. It also ignores them while Unified Claude is on by default. New conversations that are Cowork sessions follow the Cowork retention period. The Chat retention period still covers Chat conversations, such as earlier chats.
4355
4456Your other settings still apply, including [`isClaudeCodeForDesktopEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#isclaudecodefordesktopenabled), which controls Code.
4557
third-party/claude-desktop/vertex Changed · +11 / -11 lines
from line 285
285285
286286Since 1.2581.0
287287
288**Vertex AI base URL.** PSC endpoint, if using one.
288**Vertex AI base URL.** Private Service Connect endpoint, if you use one.
289289
290290***
291291
from line 305
305305
306306stringSince 1.2581.0
307307
308**Vertex OAuth client secret.** Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config.
308**Vertex OAuth client secret.** Secret for the Desktop-app OAuth client above. Google does not treat such secrets as confidential, so the Admin Console can set it.
309309
310310***
311311
from line 359
359359
360360> **More detail**
361361>
362> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration; the same rules apply here.
363> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the workforce-pool IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceVertexWorkforceOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
362> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
363> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
364364>
365> The GCP STS token-exchange step is unchanged in either flow; only how the Entra id\_token is acquired differs.
365> `broker` needs Microsoft Entra ID, with the `issuer` in `inferenceVertexWorkforceOidc` set to `https://login.microsoftonline.com/{tenant-id}/v2.0`. Add the redirect URIs listed under [Register the Entra ID application](https://claude.com/docs/third-party/claude-desktop/entra-broker.md#register-the-entra-id-application).
366366
367367***
368368
from line 374
374374
375375Since 1.10628.0
376376
377**Workforce Identity IdP (OIDC).** Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS.
377**Workforce Identity IdP (OIDC).** Your organization’s OpenID Connect identity provider. Users sign in there, and the app exchanges their ID token at GCP STS.
378378
379379> **Child attributes (9)**
380380>
from line 410
410410>
411411> **omitOfflineAccess** `boolean`
412412>
413> Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires.
413> Turn on only if your identity provider rejects offline\_access on this client. Users then sign in again each time the token expires.
414414>
415415> **additionalRedirectReferrerHosts** `string`
416416>
417> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
417> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
418418>
419419> > **More detail**
420420> >
421> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
421> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
422422
423423***
424424
from line 430
430430
431431Since 1.2581.0
432432
433**GCP credentials file path.** Absolute path to service-account JSON. Leave blank to fall back to ADC.
433**GCP credentials file path.** Full path to a service-account JSON file. Unset: Application Default Credentials.
434434
435435***
436436
claude-science/overview Changed · +1 / -1 lines
from line 40
4040
4141You pay more than your plan's price only in these cases:
4242
43* **Usage credits and extra usage.** On Pro and Max plans, you can turn on usage credits under **Settings > Usage** in Claude Science to keep working past your limits, and set a monthly spend limit there. Team plans call the same option extra usage, and your admin turns it on. In Claude Science it appears as **Usage credits**, but only Pro and Max plans can change it there. On Team and Enterprise plans, your admin sets spend limits. Some models need usage credits on some plans, and [Claude pricing](https://claude.com/pricing) lists which models each plan includes.
43* **Usage credits and extra usage.** On Pro and Max plans, you can turn on usage credits in your claude.ai settings to keep working past your limits. You can then turn off usage credits or change your monthly spend limit under **Settings > Usage** in Claude Science. Team plans call the same option extra usage, and your admin turns it on. In Claude Science it appears as **Usage credits**, but only Pro and Max plans can change it there. On Team and Enterprise plans, your admin sets spend limits. Some models need usage credits on some plans, and [Claude pricing](https://claude.com/pricing) lists which models each plan includes.
4444* **Usage-based Enterprise plans.** Instead of fixed usage limits, your organization pays for usage on top of the seat price, within the spend limits your admin sets.
4545* **Services you connect with your own account.** Services such as [Modal](https://claude.com/docs/claude-science/compute-providers.md) bill you directly. Anthropic doesn't bill for them.
4646
third-party/claude-desktop/data-storage Changed · +1 / -1 lines
from line 92
9292
9393By default, chats, Cowork tasks, and Code sessions stay on the device until the user deletes them. To delete them after a period without activity, set [`chatSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#chatsessionretentiondays), [`coworkSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#coworksessionretentiondays), or [`codeSessionRetentionDays`](https://claude.com/docs/third-party/claude-desktop/configuration#codesessionretentiondays) to a number of days from 1 to 3650. Each key covers one kind of session, and a kind you leave unset is kept until the user deletes it. Idle time counts from the session's last activity, and pinned sessions are not exempt.
9494
95With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a conversation started from the home screen where Cowork is on and the device can run it is a Cowork session. `coworkSessionRetentionDays` covers it along with users' other Cowork tasks, and `chatSessionRetentionDays` still covers Chat conversations. While `coworkSessionRetentionDays` is unset, neither key deletes a home-screen conversation that is a Cowork session, even if `chatSessionRetentionDays` is set. If you use `chatSessionRetentionDays`, keep it and set `coworkSessionRetentionDays` as well.
95With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a conversation started from the home screen on a device that can run Cowork is a Cowork session. `coworkSessionRetentionDays` covers it along with users' other Cowork tasks, and `chatSessionRetentionDays` still covers Chat conversations. While `coworkSessionRetentionDays` is unset, neither key deletes a home-screen conversation that is a Cowork session, even if `chatSessionRetentionDays` is set. If you use `chatSessionRetentionDays`, keep it and set `coworkSessionRetentionDays` as well.
9696
9797The app deletes whole sessions in the background. A chat or Cowork task is deleted with its attached files and outputs, and a Code session with its conversation. Projects, memory, and the files in a Code session's working folder stay, and Code sessions on an SSH host aren't affected. A session that is running or open on screen is skipped until a later pass.
9898
third-party/claude-desktop/installation Changed · +1 / -1 lines
from line 21
2121* **Log on as a service**: Cowork's virtual machine runs under an account in the built-in `NT VIRTUAL MACHINE\Virtual Machines` group, and that group needs the **Log on as a service** user right. If your organization assigns that right through Group Policy or MDM, see [Windows security policy blocks the Cowork workspace](#windows-security-policy-blocks-the-cowork-workspace).
2222* **Hooks**: a [hook](https://code.claude.com/docs/en/hooks) command written for Bash needs Git for Windows on the device. If your Windows devices have hooks in plugins or in Claude Code managed settings, see [Hooks on Windows devices without Git for Windows](https://claude.com/docs/third-party/claude-desktop/extensions.md#hooks-on-windows-devices-without-git-for-windows).
2323
24With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a message sent from the home screen starts a Cowork session where Cowork is on and the device can run it. On a device that can't run Cowork's virtual machine, the message starts a Chat conversation.
24With [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md) on, a message sent from the home screen starts a Cowork session on a device that can run Cowork. On a device that can't run Cowork's virtual machine, the message starts a Chat conversation.
2525
2626## Check device readiness
2727
third-party/claude-desktop/mdm Changed · +1 / -1 lines
from line 44
4444| **Egress** | A read-only firewall allowlist derived from everything you've entered above, grouped by feature **Copy hostnames**, **Download .txt**, and **Test connectivity** actions |
4545| **Source** | The bootstrap keys, if you are using the [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md) delivery model instead of a full MDM profile Bootstrap-delivered configuration takes priority over MDM-delivered values: it replaces them wholesale rather than merging key by key |
4646
47To turn on [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude), set `desktopHome` to `standard` in your MDM profile.
47To turn on [Unified Claude](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#enabling-unified-claude), set `desktopHome` to `standard` in your MDM profile. To keep Cowork off from November 10, 2026, see [Keep Cowork off](https://claude.com/docs/third-party/claude-desktop/unified-claude.md#keep-cowork-off).
4848
4949> [!NOTE]
5050>