One read of Claude Documentationclaude-docs-20261104T013713Z
15 pages moved out of 281 read.
Pages moved
15
significant first
Pages read
281
in this capture
Captured
01:37 UTC
Corpus hash
75592a2ec382
corpus-hash
What this read moved
1-15 of 15claude-tag/admins/add-connections Changed · +5 / -0 lines
from line 232
232232
233233Multiple bundles let you grant access by capability and compose it per channel. For example, with separate `data-readonly`, `github-write`, and `monitoring` bundles, `#platform-eng` gets all three, `#gtm-analytics` gets only `data-readonly`, and `#incidents` gets `monitoring` plus `github-write`. Each credential is defined once, so rotating a Datadog key means editing one bundle without touching the others.
234234
235A connector you add under a bundle's **What's in it** gets a new credential that belongs to that bundle. You can't pick a credential you already added on the **Connectors** tab or in another bundle. To use one credential in several places, set it up in one of these ways:
236
237* **In a bundle of its own**: add the connector to a bundle that holds nothing else, then add each place that needs the service under that bundle's **Where it applies**.
238* **On the Connectors tab**: [add the connector](#add-a-connector) there. A service's first credential is on in every workspace and channel as soon as you save it, so [choose its places under **Assign access**](#restrict-a-connector-to-some-channels) on the connector's page right after you save.
239
235240## Connect a service that isn't in the list
236241
237242The **Add a connector** list covers common services, not the full set Claude can connect to. Any app with an API can be connected. In the **Add a connector** dialog, select **Custom connector** at the bottom of the list. See the [custom connector guide](https://claude.com/docs/claude-tag/admins/connections/custom.md) for the form fields, credential types, and how to add a custom MCP server.
claude-tag/admins/connections/custom Changed · +4 / -3 lines
### When saving fails with "Failed to create egress credential" #### When saving fails with "Failed to create egress credential"
from line 99
9999
100100The **Private key (PEM)** field takes a PEM-encoded RSA private key without a passphrase, the format that begins with `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`. Identity providers such as Okta export the key as a JWK (a JSON object) by default; convert a JWK to PEM before pasting it. The form doesn't check the key's format, so a key in the wrong format fails only when you save.
101101
102#### When saving fails with "Failed to create egress credential"
102### When saving fails with "Failed to create egress credential"
103103
104Saving the form can return the error "Failed to create egress credential. Check your inputs and try again." The most likely cause is a private key that isn't PEM-encoded, for example a JWK pasted as-is into the **Private key (PEM)** field. Convert the key to PEM and save again.
104Saving the custom connector form can fail with the error "Failed to create egress credential. Check your inputs and try again." The message doesn't name the cause. Start by checking these values, then save again:
105105
106Saving also fails when a PEM-encoded key isn't an RSA key or has a passphrase. Once the key is in the right format, re-check each field against the values from your service.
106* **Allowed websites**: check each host you entered against the host rules in [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites).
107* **The OAuth 2.0 JWT bearer private key**: the **Private key (PEM)** field for that credential type takes a PEM-encoded RSA private key without a passphrase. A JWK (a JSON object) pasted as-is, a PEM-encoded key that isn't RSA, and a key with a passphrase all fail when you save.
107108
108109## Add a custom MCP server
109110
claude-tag/admins/restrict-access Changed · +6 / -0 lines
from line 123
123123
124124If someone invites the app into another channel afterward, Claude stays silent there. Mentioning `@Claude` in that channel gets a notice that Claude is disabled in the channel, not a reply. In a Slack Connect channel, Claude posts no notice.
125125
126Claude doesn't join a new channel that matches an [auto-join pattern](#block-or-auto-join-channels-by-name) while the channel's workspace follows the off state on the **Slack** page. To add a channel later, invite Claude to it in Slack and turn on its **Enable Claude Tag in this channel** switch at the top of the **General** tab on the channel's page.
127
126128One-to-one DMs, guest channels, and shared channels sit outside the per-scope switches:
127129
128130* **One-to-one DMs.** The per-scope switches don't cover one-to-one DMs from members who have connected a Claude account. To close those off too, turn off the [**Allow direct messages**](#allow-or-disable-direct-messages) toggle. For members who haven't connected an account, see [Stop direct messages from members without a Claude account](#stop-direct-messages-from-members-without-a-claude-account).
from line 141
139141
140142* **Blocked channel patterns**: Claude won't read or respond in a channel whose name matches, even if someone invites it there. When it's added to such a channel or @-mentioned in one, it posts a notice that an admin has blocked it there, and otherwise stays silent. In a Slack Connect channel, it posts no notice.
141143* **Auto-join channels**: Claude joins a public channel whose name matches one of its patterns when the channel is created or renamed. Private channels still need an invite. To add Claude to an existing channel, invite it as usual.
144
145> [!NOTE]
146>
147> An auto-join pattern doesn't turn Claude on in a channel, and Claude doesn't join a matching channel while the **Enable Claude Tag** switch that covers it is off. A new channel has no setting of its own, so it follows its workspace's setting or, when the workspace has none, the setting on the **Slack** page. To have Claude respond in a matching channel while it's off elsewhere, turn on that channel's own switch as described in [Limit Claude Tag to specific channels](#limit-claude-tag-to-specific-channels).
142148
143149Each row of the **Auto-join channels** table is one pattern, added with **Add pattern**. A row can also carry [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), which attach in every matching channel Claude is in; a row with no bundles is marked **Auto-join only**, and Claude joins matching channels whether or not a row carries bundles. A channel rule added with **Add a channel rule…** on the **Channels** tab shows up as a row here too. Editing the patterns or the bundles on a row needs an Owner of your Claude organization.
144150
claude-tag/admins/troubleshooting Changed · +21 / -5 lines
### You don't have permission to change this setting
from line 272
272272
273273**What you see**
274274
275You ask Claude to do something that involves a channel shared across your Enterprise Grid, and the refusal names the request it declined and ends:
275You ask Claude to do something that involves a channel shared across your Enterprise Grid, and Claude declines. Claude writes the refusal in its own words, so the wording you see may differ. It can give this reason:
276276
277277> Claude isn't available in channels shared across your Enterprise Grid
278278
279279**What it means**
280280
281The request needed Claude to act in a channel that's shared across more than one workspace in your Enterprise Grid. The message appears in whichever conversation you made the request; the entries above cover the replies Claude posts in the shared channel itself.
281The request needed Claude to act in a channel that's shared across more than one workspace in your Enterprise Grid. The reply appears in whichever conversation you made the request; the entries above cover the replies Claude posts in the shared channel itself.
282282
283This refusal covers both sharing cases. Even when the shared channel's workspaces all belong to your one Claude organization and Claude answers direct mentions there, Claude still declines requests made from another conversation.
283Claude can't write to the channel from a conversation outside it, even if every workspace in the channel belongs to your one Claude organization and Claude answers direct mentions there.
284284
285285**How to resolve**
286286
from line 387
387387
388388Ask the Slack admin to send `@Claude connect` again and paste the fresh code right away. Reinstalling the app is not required.
389389
390### You don't have permission to change this setting
391
392**What you see**
393
394You change a Claude Tag setting at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), or on the **Admin** tab of a channel's [Configure page](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), and an error message appears:
395
396> You don't have permission to change this setting. Your previous setting is unchanged.
397
398**What it means**
399
400Your role lets you open the Claude Tag settings but doesn't include permission to change this one. Some settings, such as **Channels Claude can search**, need an Owner of your Claude organization even when your role includes the **Claude Tag Admin** permission.
401
402**How to resolve**
403
404Ask an Owner of your Claude organization to make the change. To check which settings need an Owner before you ask, see [Delegate Claude Tag administration](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
405
390406## Nothing responds
391407
392408Most of the silence problems in this section span a whole workspace or channel and come down to the app's authorization or configuration. If Claude stays silent in one thread but answers everywhere else, a setting isn't the cause. Either Claude's session for that thread is stuck, or the thread is muted. See [Claude went silent in one thread, but responds elsewhere](#claude-went-silent-in-one-thread-but-responds-elsewhere).
from line 494
478494
479495> This workspace isn't set up for Claude Tag yet. A workspace admin can run `@Claude connect`, or set it up here.
480496
481The reply varies with the sender: someone who isn't a Slack workspace admin is told to ask their Claude workspace owner to run `@Claude connect`, without the settings link. In a channel shared across workspaces in an Enterprise Grid where none of the sharing workspaces is paired yet, the reply reads "None of the Slack workspaces this channel is shared with is set up for Claude Tag yet. A workspace admin can set one up here."
497The reply varies with the sender: someone who isn't a Slack workspace admin is told to ask a Slack workspace admin to run `@Claude connect`, without the settings link. In a channel shared across workspaces in an Enterprise Grid where none of the sharing workspaces is paired yet, the reply reads "None of the Slack workspaces this channel is shared with is set up for Claude Tag yet. A workspace admin can set one up here."
482498
483499**What it means**
484500
claude-tag/users/good-habits Changed · +3 / -3 lines
from line 17
1717* **Work in public.** Assume everyone in the channel can read the thread, including its checklist and results. Anything your team writes down, like decisions, conventions, and postmortems, is context Claude can use. Knowledge that lives in DMs or was only said aloud is invisible to it. Put anything personal in a DM instead.
1818* **Share control.** Replying in a thread someone else started is how work moves. Redirect the approach, add what the requester didn't know, or pick up the result and run with it.
1919* **Grant broad access.** A channel with more connections (the tools an admin linked for this channel, like GitHub or Drive) produces more useful results, because Claude can join more sources together. The connections are scoped to the agent's identity, so granting them to a channel does not expose anyone's personal data.
20* **Give Claude the destination, not the route.** State the outcome you want and let Claude work out the steps; the [definition of done](#give-every-task-a-definition-of-done) below makes that concrete.
21* **Tolerate the mess.** A first draft posted in the thread is more useful than a polished one in a DM. The thread is the workspace, not the deliverable.
20* **Name the outcome.** Say what you want done and let Claude work out the steps. Give the task a [definition of done](#give-every-task-a-definition-of-done).
21* **Tolerate the mess.** A first draft posted in the thread is more useful than a polished one in a DM.
2222
2323### Mentioning people who aren't in the channel
2424
from line 76
7676* **The condition must be observable by Claude.** "Done when CI is green" requires access to CI. If the proof lives in a system the channel isn't connected to, change the condition to one you close yourself.
7777* **Spell out everything the condition includes.** "Babysit this PR until it merges" can produce a merge the moment approvals arrive, before open review comments are addressed. If the full condition is approvals present, comments resolved, and your final go-ahead, write all three into the task.
7878
79For tasks Claude closes itself, ask it to attach proof, such as the source link, the chart, the test output, or the diff. You read the proof, not the transcript.
79For tasks Claude closes itself, ask it to attach proof, such as the source link, the chart, the test output, or the diff. With that proof, you can confirm the work without going through every step Claude took.
8080
8181For long-running work, make getting the deliverable somewhere durable part of the definition. Post the file to the thread, push the branch, or open the draft pull request as it goes. See [what survives between replies](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
8282
claude-tag/admins/attach-to-scope Changed · +3 / -1 lines
from line 37
3737* **From the bundle's page**: on the **Bundles** tab, open the bundle. Under **Where it applies**, turn on the switch for **Slack** or for a workspace, or select **Add place**, pick a channel under **Where**, and select **Add**. Then select **Save changes**.
3838* **From a workspace's or channel's page**: on the **Channels** tab, open the page, select **Add** under **Claude's access**, choose **Bundle**, and pick the bundle.
3939
40To stop a bundle applying somewhere, open the bundle's page and turn off that place's switch under **Where it applies**. For a workspace or channel, you can instead choose **Remove from bundle** from its row menu. Then select **Save changes**. A workspace's or channel's page lists the bundles that reach it, and each links to the bundle's page, but the page itself doesn't remove them.
40To stop a bundle applying somewhere, open the bundle's page and turn off that place's switch under **Where it applies**. For a workspace or channel, you can instead choose **Remove from bundle** from its row menu. Then select **Save changes**.
41
42You can also remove a bundle on a workspace's or channel's own page when the bundle was added to that place directly, from either page. Under **Claude's access**, open the bundle's row menu and select **Remove from** followed by the place's name. The bundle comes off at once.
4143
4244The change takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connector added after a thread started still works there if you ask Claude to use the service by name. Test with a new top-level thread after changing where a bundle applies. See [What survives between replies](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
4345
claude-tag/admins/configure-gitlab Changed · +1 / -1 lines
from line 8
88
99Connecting GitLab lets Claude read repository contents, manage issues, review and comment on merge requests, and check pipeline status from any channel where the GitLab connector applies, all through the GitLab API. Unlike GitHub, there is no Claude app to install in GitLab. Instead, you give Claude its own GitLab user and add that user's personal access token as a connector.
1010
11The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
11The connector is API-only. The token authenticates GitLab API requests, not git, so over HTTPS, cloning a private project or pushing to any project fails, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
1212
1313A dedicated service account keeps Claude's GitLab activity attributed to a single identity you control. You decide which groups and projects it can reach by granting that account membership the same way you would for a person, and you can revoke or rescope it at any time without touching anyone else's access.
1414
claude-tag/admins/connections/gitlab Changed · +1 / -1 lines
from line 42
4242| Self-managed | Your hostname under **Advanced > Allowed websites** | [GitHub Enterprise setup](https://claude.com/docs/claude-tag/admins/configure-github.md#github-enterprise) |
4343| Handing back changes | Manages issues and comments on merge requests through the API | [Draft pull requests](https://claude.com/docs/claude-tag/users/use-cases/work-with-github.md) authored by the Claude GitHub App |
4444
45The connector is API-only. The token authenticates GitLab API requests, not git, so Claude gets a 401 error when it tries to clone a private project or push to any project over HTTPS, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
45The connector is API-only. The token authenticates GitLab API requests, not git, so over HTTPS, cloning a private project or pushing to any project fails, even with the connector in place. To clone a repository into the session workspace, connect it through [GitHub](https://claude.com/docs/claude-tag/admins/configure-github.md) instead.
4646
4747The token is auto-injected on every API request to your GitLab host. The model and the sandbox are not given the key; see [how Agent Proxy works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
4848
claude-tag/admins/customize Changed · +1 / -1 lines
from line 117
117117| An API key, token, or other credential | A [connector](https://claude.com/docs/claude-tag/admins/add-connections.md), never an environment variable |
118118| Setup for one repository, such as installing its dependencies | That repository's `CLAUDE.md`; see [install project dependencies](https://claude.com/docs/claude-tag/admins/configure-github.md#install-project-dependencies) |
119119
120Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. There is no separate secrets store. A connector stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) describes how. A connector in a bundle also travels with that bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
120Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. A connector stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) describes how. A connector in a bundle also travels with that bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
121121
122122### Create the environment and choose it on a scope
123123
claude-tag/admins/set-spend-limit Changed · +1 / -1 lines
from line 29
2929
3030## Set the spend limit
3131
32Not every organization sees this page. A trial organization that hasn't enabled usage billing, a single-seat Team plan, an organization with a hybrid desktop deployment, or an admin whose role can't view billing is redirected to personal usage settings instead. If your organization bills through a reseller, the page is not available and these steps don't apply; your organization's usage is funded through the reseller instead.
32Not every organization sees this page. A trial organization that hasn't enabled usage billing, a single-seat Team plan, or an admin whose role can't view billing is redirected to personal usage settings instead. An organization with a hybrid desktop deployment is redirected to personal settings. If your organization bills through a reseller, the page is not available and these steps don't apply; your organization's usage is funded through the reseller instead.
3333
3434**1. Open the usage page**
3535
claude-tag/users/memory Changed · +1 / -1 lines
from line 38
3838
3939### Make an instruction stick
4040
41Memory is a curated note, not a transcript. To make something permanent, say so explicitly:
41Claude decides what to save, so it may not keep something you said in passing. To make something permanent, say so explicitly:
4242
4343```text wrap theme={null}
4444@Claude remember for this channel: changes go to acme/data-pipeline, never acme/website, and run the lint check before opening any pull request.
claude-tag/users/proactivity Changed · +2 / -0 lines
from line 20
2020
2121Name the output format in the job so recurring posts stay scannable.
2222
23You can schedule a job to run at most once an hour, and Claude declines a schedule that runs more often.
24
2325### Watch channels
2426
2527Ask Claude to watch named channels and post here when something matches a topic:
claude-tag/users/prompt-library Changed · +1 / -1 lines
from line 80
8080@Claude what do you remember about this channel?
8181```
8282
83**Why it works**: memory is a curated note and Claude decides what's worth keeping, so you have to ask to know what stuck.
83**Why it works**: Claude decides what to save, so ask to see what it kept.
8484
8585```text wrap theme={null}
8686@Claude that's outdated — forget the entry about the old project name.
claude-tag/users/troubleshooting Changed · +2 / -2 lines
from line 126
126126
127127A channel shared across workspaces inside your Enterprise Grid is different. When every workspace in the channel belongs to your one Claude organization and an admin hasn't turned Claude off for these channels, Claude answers, but with only your organization's default access and settings, so a repository or an instruction set up for that channel doesn't apply. A notice in the thread points this out from time to time. If an admin has turned it off, you can see "Claude is off in channels shared across your Slack workspaces" instead of an answer. When the workspaces are connected to different Claude organizations, you see "This channel is shared among several Claude workspaces, so Claude cannot respond here" instead of an answer.
128128
129Where guest access is restricted, you may first see "This channel is shared across multiple workspaces, and Claude can't verify whether it includes guests, so Claude can't respond here." If you ask Claude from another conversation to act in one of these channels, such as posting a message there, you see a reply that ends "Claude isn't available in channels shared across your Enterprise Grid".
129Where guest access is restricted, you may first see "This channel is shared across multiple workspaces, and Claude can't verify whether it includes guests, so Claude can't respond here."
130130
131131Each of these Enterprise Grid messages means the channel spans more than one workspace. The [admin entries on these messages](https://claude.com/docs/claude-tag/admins/troubleshooting.md#this-channel-is-shared-across-multiple-workspaces) explain what causes each one and what an admin can change.
132132
from line 458
458458
459459**What it means**
460460
461Channel memory is a small, curated note, not a transcript, and Claude decides what's worth saving, so passing details usually aren't kept.
461Claude decides what's worth saving to channel memory, so it may not have kept something you said in passing.
462462
463463**How to resolve**
464464
claude-tag/users/use-cases/work-with-github Changed · +2 / -2 lines
from line 78
7878@Claude a user reports that exports drop rows with empty dates. In acme/data-pipeline, is that a bug or intended behavior? If it's a bug, open a draft PR with a fix; if it's intended, explain here what the code does.
7979```
8080
81For the full arc from a bug report to green CI, including a standing watch that triages a bug channel, see [Fix bugs](https://claude.com/docs/claude-tag/users/use-cases/fix-bugs.md). Because the prompt asks for either a fix or an explanation, the thread gets an answer even when the behavior turns out to be intended.
81Because the prompt asks for either a fix or an explanation, the thread gets an answer even when the behavior turns out to be intended. For more prompts that start from a bug report, see [Fix bugs](https://claude.com/docs/claude-tag/users/use-cases/fix-bugs.md).
8282
8383### Hand off a change and follow its pull request in one message
8484
from line 118
118118
119119> [card] [Fix bugs](https://claude.com/docs/claude-tag/users/use-cases/fix-bugs.md)
120120>
121> The full arc from a bug report to a draft pull request and green CI
121> Prompts to fix a reported bug, watch a bug channel, and more
122122
123123> [card] [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md)
124124>