Deploy Claude Desktop on 3P with an LLM gateway

 
     **The gateway MUST validate `iss` AND `aud`, not just the signature.** Signature + issuer alone accepts *any* token from the same tenant, including tokens issued to unrelated apps. In `id_token` mode the audience is the `clientId`:
 
-    ```yaml theme={null}
+    ```yaml theme={null} theme={null} theme={null} theme={null}
     # LiteLLM example — `audience` is REQUIRED, not optional
     general_settings:
       litellm_jwtauth:

 
 Single sign-on is enabled by setting `inferenceCredentialKind` to `interactive` **and** supplying `inferenceGatewayOidc`. Both are required — `interactive` alone (without `inferenceGatewayOidc`) selects a different mode where the gateway itself acts as the authorization server.
 
-| Setting                | MDM key                   | Required                    | Description                                                                                                                                    |
-| ---------------------- | ------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| Credential kind        | `inferenceCredentialKind` | Yes — must be `interactive` | Selects sign-in instead of an API key.                                                                                                         |
-| Gateway SSO IdP (OIDC) | `inferenceGatewayOidc`    | Yes                         | A **single JSON object** describing the identity provider (fields below). The resulting token is sent to the gateway as the bearer credential. |
+| Setting                | MDM key                        | Required                    | Description                                                                                                                                                                                                                                                                                                                      |
+| ---------------------- | ------------------------------ | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Credential kind        | `inferenceCredentialKind`      | Yes — must be `interactive` | Selects sign-in instead of an API key.                                                                                                                                                                                                                                                                                           |
+| Gateway SSO IdP (OIDC) | `inferenceGatewayOidc`         | Yes                         | A **single JSON object** describing the identity provider (fields below). The resulting token is sent to the gateway as the bearer credential.                                                                                                                                                                                   |
+| Sign-in flow           | `inferenceGatewayOidcAuthFlow` | No                          | `browser` (the default) runs the sign-in in the system browser. `broker` runs it through the [OS identity broker](/docs/third-party/claude-desktop/entra-broker) on Windows and macOS, which requires `issuer` to be a Microsoft Entra ID issuer (`https://login.microsoftonline.com/TENANT_ID/v2.0`) and needs no loopback redirect. |
 
 The `inferenceGatewayOidc` value is one JSON object with these fields:
 

 
 ## Troubleshoot
 
-**`gateway SSO: server does not advertise device_authorization_endpoint`** — The app could not read your `inferenceGatewayOidc` value, so it fell back to treating the gateway itself as the sign-in server. Almost always this means the value is not a valid JSON string (for example, separate dotted keys, or a plist `<dict>` instead of a `<string>`). Re-export from the in-app configuration window, or copy the `.mobileconfig` snippet above.
+**`gateway SSO: server does not advertise device_authorization_endpoint`** — The app could not read your `inferenceGatewayOidc` value, so it fell back to treating the gateway itself as the sign-in server. Almost always this means the value is missing or not valid JSON, for example because it was written as separate dotted keys instead of one `inferenceGatewayOidc` value. Re-export from the in-app configuration window, or copy the `.mobileconfig` snippet above.
 
 **`OIDC discovery failed (HTTP 404)` or `(HTTP 405)`** — The `issuer` value is not the issuer base URL. Most often the metadata URI (ending in `/.well-known/openid-configuration`) was pasted instead, which doubles the path. Remove that suffix so `issuer` is just `https://YOUR_ORG.okta.com` (or the equivalent for your provider).