Connect Claude Code to Claude for Government changedgovernment/deploy-claude-code/configure
Nearest release: v2.1.299, published 8 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 13 Oct 2026 15:23 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 13 Oct 2026 15:37 UTC.
Upstream edited
Recorded here
Lines+6added
Lines−6removed
From line
17
where the diff opens
First seen
30 Sep 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 17, old and new numbered
/
from line 17
1717* **Claude Code is current.** This setup requires Claude Code 2.1.267 or later (`claude --version`).
1818* **Claude Desktop is current.** Update Claude Desktop to [the supported version](/docs/government/deploy-desktop/configure#before-you-begin) before turning on Claude Code for the terminal.
1919* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the Claude for Government host, its sign-in service, and your agency's identity provider, the same hosts that [Claude Desktop sign-in](/docs/government/deploy-desktop/configure#before-you-begin) needs.
20* **You can place a system-level file or policy.** The settings count only from a system-level location: a file in a system directory, a macOS configuration profile, or a machine-level Windows registry policy. Deliver them through your device management system or by hand with administrator rights.
20* **You can place a system-level file or policy.** The settings are enforced only from a system-level location: a file in a system directory, a macOS configuration profile, or a machine-level Windows registry policy. Deliver them through your device management system or by hand with administrator rights.
2121
2222## The managed settings
2323
24Claude Code reads device-level policy from what it calls managed settings. For Claude for Government they contain two keys that turn on gateway sign-in, an `env` block, and one key recommended on devices that also run Claude Desktop.
24Claude Code reads device-level policy from what it calls managed settings. For Claude for Government they contain two keys that turn on gateway sign-in, an `env` block, and one optional key for devices that also run Claude Desktop.
2525
2626| Key | Value | Purpose |
2727| - | - | - |
from line 28
2828| `forceLoginMethod` | `"gateway"` | Required. Replaces Claude Code's sign-in choices with a single **Cloud gateway** screen. |
2929| `forceLoginGatewayUrl` | The Claude for Government gateway address | Required. The address the **Cloud gateway** screen connects to. |
3030| `env` | The eight variables shown below | Required. Keeps Claude Code's telemetry to Anthropic and its pre-sign-in background connections off from the first launch, and sets its request headers, request body fields, and certificate checking as described below. |
31| `parentSettingsBehavior` | `"merge"` | Recommended on devices that also run Claude Desktop, harmless elsewhere: Code sessions inside Claude Desktop then keep Claude Desktop's own restrictions alongside these settings, as [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) describes. |
31| `parentSettingsBehavior` | `"merge"` | Optional. Where these managed settings govern Code sessions in Claude Desktop, `"merge"` layers Claude Desktop's own restrictions, its sandbox included, under them, as [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) describes. |
3232
3333As a `managed-settings.json` file:
3434
from line 52
5252
5353Your Anthropic representative provides the gateway address. Replace `<claude-for-government-gateway-address>` with it so the value is the full address starting with a single `https://`, including any path. The address is the same for every device and contains no credentials, so one file serves your whole fleet.
5454
55Claude Code honors the two sign-in keys only from a system-level location and ignores them in a user's own settings or a per-user registry policy.
55Claude Code requires the gateway sign-in only when the two sign-in keys come from a system-level location. Set there, they take the place of the same keys in a user's own settings file; a value in a per-user registry policy does not turn the sign-in on.
5656
5757### Before sign-in
5858
from line 161
161161
162162## Things to know
163163
164* Only the gateway sign-in described on this page delivers the organization's settings to Claude Code.
164* Only the gateway sign-in described on this page delivers the organization's settings to the Claude Code command-line tool. Once a user is signed in, those settings replace the Claude Code policy in these managed settings, hooks and permission rules included, apart from the two sign-in keys, any `env` variables the organization's settings leave unset, and the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source).
165165* A claude.ai sign-in left on a device from earlier use is ignored once these settings are in place. A leftover `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `apiKeyHelper`, or saved Claude Console key is not: until the user has signed in through the gateway, Claude Code stops and asks for its removal, as [Troubleshooting](#troubleshooting) describes.
166166* Where the Claude Code extension for VS Code is used, have users remove an earlier claude.ai sign-in with `claude auth logout` or the extension's **Claude Code: Logout** command before they sign in through the gateway, not after: both commands clear every credential Claude Code has stored, the gateway sign-in included.
167167* To take a device out of this setup, have its users sign out with `claude auth logout` before you remove the settings.
168168* After sign-in, the organization's settings turn off the Claude Code settings that run a helper command (`apiKeyHelper`, `proxyAuthHelper`, `awsAuthRefresh`, `awsCredentialExport`, `gcpAuthRefresh`, `otelHeadersHelper`), wherever it is set. If your devices reach the network through a proxy that needs a helper command to authenticate, raise this with your Anthropic representative before you deploy.
169169* With these settings Claude Code does not check for or install updates in the background. Distribute new versions through your software deployment tooling, or have users run `claude update` (standard installer) or their package manager.
170* Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but on a device that has this file its `env` block applies to them too, and `parentSettingsBehavior` set to `"merge"` keeps Claude Desktop's own restrictions in force alongside it.
170* Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but the `env` block applies to them too. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop).
171171
No line in this hunk matches that.