Give Claude access to your tools changedclaude-tag/admins/add-connections
Nearest release: v2.1.290, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 18:53 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+43added
Lines−43removed
From line
8
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits25to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99> [!TIP]
1010>
11> Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects).
11> Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up.md), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests.md), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts.md), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects.md).
1212
13A connector gives Claude its own credential for one of your tools, like a Datadog API key or a warehouse service account, so Claude can act in that tool from Slack channels. This page is for the admins who add connectors and decide where they apply. To let Claude act as a member with that member's own claude.ai connectors, see [Personal connectors](/docs/claude-tag/concepts/personal-connectors) instead.
13A connector gives Claude its own credential for one of your tools, like a Datadog API key or a warehouse service account, so Claude can act in that tool from Slack channels. This page is for the admins who add connectors and decide where they apply. To let Claude act as a member with that member's own claude.ai connectors, see [Personal connectors](/docs/claude-tag/concepts/personal-connectors.md) instead.
1414
15Adding connectors and bundles requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) in your Claude organization. You manage both in [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag), under **Claude's access**, which appears once the **Enable Claude Tag in Slack** switch is on.
15Adding connectors and bundles requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization. You manage both in [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag), under **Claude's access**, which appears once the **Enable Claude Tag in Slack** switch is on.
1616
17Connectors belong to the [agent identity](/docs/claude-tag/concepts/agent-identity), not to any person. Personal claude.ai connectors apply in one-to-one DMs. Claude can also [use a member's own connectors in a channel](/docs/claude-tag/concepts/personal-connectors) for that member's own tasks, after the member allows it.
17Connectors belong to the [agent identity](/docs/claude-tag/concepts/agent-identity.md), not to any person. Personal claude.ai connectors apply in one-to-one DMs. Claude can also [use a member's own connectors in a channel](/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
1818
1919## Decide what to connect
2020
from line 24
2424
2525| Connect | Examples | Recommended access | What it adds |
2626| :- | :- | :- | :- |
27| Knowledge and docs | Google Drive, [Notion](/docs/claude-tag/admins/connections/notion), [Confluence](/docs/claude-tag/admins/connections/atlassian) | Read | Answers grounded in design docs, runbooks, and prior decisions |
28| Code | GitHub, [GitLab](/docs/claude-tag/admins/connections/gitlab) | Read and write | On GitHub, branches, pull requests, review, and CI follow-up through the [Claude GitHub App](/docs/claude-tag/admins/configure-github). On GitLab, issues, merge request comments, and pipeline checks through its API |
29| Data warehouse | BigQuery, [Snowflake](/docs/claude-tag/admins/connections/snowflake), Redshift | Read | Data questions answered with charts in the thread; recurring reports |
30| Monitoring | [Sentry](/docs/claude-tag/admins/connections/sentry), [Datadog](/docs/claude-tag/admins/connections/datadog), [PagerDuty](/docs/claude-tag/admins/connections/pagerduty) | Read | Logs, metrics, and errors for debugging and incident work |
31| Issue tracking | [Linear](/docs/claude-tag/admins/connections/linear), [Asana](/docs/claude-tag/admins/connections/asana), [Jira](/docs/claude-tag/admins/connections/atlassian) | Read and write | File tickets and post status updates where work lives |
32| Go-to-market | [HubSpot](/docs/claude-tag/admins/connections/hubspot), [Gong](/docs/claude-tag/admins/connections/gong), [Salesforce](/docs/claude-tag/admins/connections/salesforce) | Read | Pipeline and customer state for account questions |
27| Knowledge and docs | Google Drive, [Notion](/docs/claude-tag/admins/connections/notion.md), [Confluence](/docs/claude-tag/admins/connections/atlassian.md) | Read | Answers grounded in design docs, runbooks, and prior decisions |
28| Code | GitHub, [GitLab](/docs/claude-tag/admins/connections/gitlab.md) | Read and write | On GitHub, branches, pull requests, review, and CI follow-up through the [Claude GitHub App](/docs/claude-tag/admins/configure-github.md). On GitLab, issues, merge request comments, and pipeline checks through its API |
29| Data warehouse | BigQuery, [Snowflake](/docs/claude-tag/admins/connections/snowflake.md), Redshift | Read | Data questions answered with charts in the thread; recurring reports |
30| Monitoring | [Sentry](/docs/claude-tag/admins/connections/sentry.md), [Datadog](/docs/claude-tag/admins/connections/datadog.md), [PagerDuty](/docs/claude-tag/admins/connections/pagerduty.md) | Read | Logs, metrics, and errors for debugging and incident work |
31| Issue tracking | [Linear](/docs/claude-tag/admins/connections/linear.md), [Asana](/docs/claude-tag/admins/connections/asana.md), [Jira](/docs/claude-tag/admins/connections/atlassian.md) | Read and write | File tickets and post status updates where work lives |
32| Go-to-market | [HubSpot](/docs/claude-tag/admins/connections/hubspot.md), [Gong](/docs/claude-tag/admins/connections/gong.md), [Salesforce](/docs/claude-tag/admins/connections/salesforce.md) | Read | Pipeline and customer state for account questions |
3333
3434Per-service instructions, with the credential fields and allowed-websites values, are in the [connection guides](/docs/claude-tag/admins/connections/overview).
3535
from line 61
6161A connector has no setting for which pages, folders, or projects Claude can reach inside a tool. The connector's reach is whatever the connected account can access in that tool. To narrow Claude to a subset, narrow the account:
6262
6363* **Confluence or another wiki:** give the service account read access to only the spaces or pages Claude should see
64* **Google Drive:** share only the relevant folders with the dedicated Google account; see [Google Workspace](/docs/claude-tag/admins/connections/google)
64* **Google Drive:** share only the relevant folders with the dedicated Google account; see [Google Workspace](/docs/claude-tag/admins/connections/google.md)
6565* **Project or ticket trackers:** add the service account to only the projects it needs
6666
6767The host, path, and method restrictions on a credential control which API endpoints Claude can call, not which records those endpoints return. Use them alongside account-level scoping, not instead of it.
from line 84
8484
8585**2. Pick the service**
8686
87In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list).
87In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github.md). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list).
8888
8989For a service that offers a sign-in as well as a key, such as Amplitude, the dialog then shows **How Claude authenticates**. Leave **Paste an API key** selected, or select the sign-in option, such as **Sign in to Amplitude as Claude**, and click **Continue to** *service*.
9090
from line 147
147147
148148### Claude Tag connectors vs personal claude.ai connectors
149149
150The **Add a connector** dialog lists services Claude can hold its own credential for, not the connectors your organization or its members have set up on claude.ai. A Claude Tag connector authenticates the agent, not a person; a connector on someone's personal claude.ai account doesn't appear there. For Google services, use a service-account key or sign in with an account made for Claude, both of which give the agent one credential with access to the data the channel needs. Personal connectors keep working in [DMs](/docs/claude-tag/concepts/agent-identity#direct-message-channels).
150The **Add a connector** dialog lists services Claude can hold its own credential for, not the connectors your organization or its members have set up on claude.ai. A Claude Tag connector authenticates the agent, not a person; a connector on someone's personal claude.ai account doesn't appear there. For Google services, use a service-account key or sign in with an account made for Claude, both of which give the agent one credential with access to the data the channel needs. Personal connectors keep working in [DMs](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
151151
152152## Change an existing connector
153153
from line 208
208208
209209## Create a bundle
210210
211A [bundle](/docs/claude-tag/concepts/glossary#access-bundle) is a named set of connectors, repositories, domain entries, plugins, and instructions that Claude takes on wherever the bundle applies. Use one to give a group of channels the same access, and to add a connector to only some channels from the start.
211A [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) is a named set of connectors, repositories, domain entries, plugins, and instructions that Claude takes on wherever the bundle applies. Use one to give a group of channels the same access, and to add a connector to only some channels from the start.
212212
213213**1. Create the bundle**
214214
from line 222
222222
223223Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. A bundle applies nowhere until you turn on a row or add a place.
224224
225To add an existing bundle from a workspace or channel instead, open that place's page from the **Channels** tab, click **Add** under **Claude's access**, and select **Bundle**. [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope) covers channel rules and how bundles combine.
225To add an existing bundle from a workspace or channel instead, open that place's page from the **Channels** tab, click **Add** under **Claude's access**, and select **Bundle**. [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope.md) covers channel rules and how bundles combine.
226226
227227Name a bundle after what it grants, since the name is what you'll read when deciding which bundles to add to a channel: `data-readonly`, `github-write`, `monitoring`, `gtm-tools`. A capability name stays meaningful when the same bundle serves several teams; a team name (`devprod-team`) works when one team's full access is the unit you'll reuse.
228228
229Use the bundle's **Instructions** section for guidance that should travel with its connectors; use [workspace or channel instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) for guidance tied to a place.
229Use the bundle's **Instructions** section for guidance that should travel with its connectors; use [workspace or channel instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) for guidance tied to a place.
230230
231231### Why create more than one bundle
232232
from line 234
234234
235235## Connect a service that isn't in the list
236236
237The **Add a connector** list covers common services, not the full set Claude can connect to. Any app with an API can be connected. In the **Add a connector** dialog, select **Custom connector** at the bottom of the list. See the [custom connector guide](/docs/claude-tag/admins/connections/custom) for the form fields, credential types, and how to add a custom MCP server.
237The **Add a connector** list covers common services, not the full set Claude can connect to. Any app with an API can be connected. In the **Add a connector** dialog, select **Custom connector** at the bottom of the list. See the [custom connector guide](/docs/claude-tag/admins/connections/custom.md) for the form fields, credential types, and how to add a custom MCP server.
238238
239239For a custom connector, choose the **Credential type** that matches how the service authenticates:
240240
from line 244
244244| Basic | HTTP Basic authentication. |
245245| Body parameter | A token the API expects in the request body or query string instead of a header. |
246246| AWS SigV4 | Signed requests to AWS service endpoints with an access key pair. |
247| GCP access token (with Service Account Key) | Google Cloud APIs via a service-account JSON key. Google Workspace services like Drive and Calendar also use this; see [the Google guide](/docs/claude-tag/admins/connections/google). |
247| GCP access token (with Service Account Key) | Google Cloud APIs via a service-account JSON key. Google Workspace services like Drive and Calendar also use this; see [the Google guide](/docs/claude-tag/admins/connections/google.md). |
248248| GCP IAP (with Service Account Key) | Google Cloud services behind Identity-Aware Proxy. |
249249| OAuth 2.0 JWT bearer | Server-to-server OAuth. |
250250| OAuth 2.0 client credentials | Server-to-server OAuth. Salesforce uses this. |
251| MCP Connector | Sign in once as an admin; the agent acts as that account. The picker offers a fixed set of providers plus the [remote MCP connectors](/docs/connectors/custom/add-unlisted) your organization has added on claude.ai. Other OAuth APIs can't be connected this way. |
251| MCP Connector | Sign in once as an admin; the agent acts as that account. The picker offers a fixed set of providers plus the [remote MCP connectors](/docs/connectors/custom/add-unlisted.md) your organization has added on claude.ai. Other OAuth APIs can't be connected this way. |
252252
253For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github) rather than a credential from this table.
253For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github.md) rather than a credential from this table.
254254
255Credentials are injected at the network boundary by Agent Proxy; the model and the sandbox are not given the key. A request to a host you haven't allowed is blocked, not sent. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity#agent-proxy).
255Credentials are injected at the network boundary by Agent Proxy; the model and the sandbox are not given the key. A request to a host you haven't allowed is blocked, not sent. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
256256
257You can also add connectors from a channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel). The option to add one appears there only for people who can manage Claude's setup for that channel or for the whole organization. [Channel managers](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can manage setup for their assigned channels. Other channel members see the channel's connectors on the Configure page but can't add one.
257You can also add connectors from a channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel). The option to add one appears there only for people who can manage Claude's setup for that channel or for the whole organization. [Channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can manage setup for their assigned channels. Other channel members see the channel's connectors on the Configure page but can't add one.
258258
259259## Allow a host without a credential
260260
261Claude does channel work in an isolated [sandbox](/docs/claude-tag/concepts/agent-identity#channel-sessions). A network request is traffic that sandbox sends to a host, such as an API call, a `curl` fetch, or a package install. Before Claude can make one from a channel, the destination host has to be allowed by one of three settings, the allow layers:
261Claude does channel work in an isolated [sandbox](/docs/claude-tag/concepts/agent-identity.md#channel-sessions). A network request is traffic that sandbox sends to a host, such as an API call, a `curl` fetch, or a package install. Before Claude can make one from a channel, the destination host has to be allowed by one of three settings, the allow layers:
262262
263263* **A domain entry**: a hostname added to a bundle that applies to the channel. Requests to it pass with no credential attached; see [Add a domain](#add-a-domain).
264264* **A [connector](#add-a-connector)**: a credential that applies to the channel. Requests matching its [allowed websites](#set-allowed-websites) pass with that credential attached.
265* **The channel's [environment](/docs/claude-tag/concepts/glossary#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
265* **The channel's [environment](/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
266266
267267A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests).
268268
from line 280
280280
281281You don't have to predict the full list up front. When a request is blocked, Claude says so in the thread and names the host, with wording like "blocked by the network egress proxy" (that is, by Agent Proxy); add that host here and retry. If the host is listed and Claude still reports it blocked, check these in order:
282282
283* **The bundle applies to the channel.** The bundle's **Where it applies** list must include the channel, its workspace, a channel group that matches it, or **Slack**; see [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope).
283* **The bundle applies to the channel.** The bundle's **Where it applies** list must include the channel, its workspace, a channel group that matches it, or **Slack**; see [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope.md).
284284* **The entry matches the exact host.** A wildcard like `*.example.com` doesn't cover `example.com` itself, and `www.example.com` and `example.com` are different hosts.
285285* **The request didn't move to another host.** If the page redirects, or loads from a CDN or a sign-in host, allow that host too; Claude names the host it was blocked on.
286286* **The port is listed.** Needed only when the service listens on something other than 443.
from line 293
293293
294294> [!NOTE]
295295>
296> [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH.
296> [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH.
297297
298298### Broad web access through the environment
299299
300Domain entries allow hosts one at a time. For a channel whose work needs more of the web, the environment setting grants broader access. An [environment](/docs/claude-tag/concepts/glossary#environment) is the sandboxed compute configuration the channel's sessions run in, and it carries its own network access setting.
300Domain entries allow hosts one at a time. For a channel whose work needs more of the web, the environment setting grants broader access. An [environment](/docs/claude-tag/concepts/glossary.md#environment) is the sandboxed compute configuration the channel's sessions run in, and it carries its own network access setting.
301301
302302A new environment's network access level is Trusted access, which allows a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). A channel can already reach hosts like `pypi.org` and `registry.npmjs.org` with no domain entry.
303303
304To give a workspace or channel broader access, create an organization-shared environment with a more permissive level and set it on that place's page, under **Advanced > Sessions > Environment**, as described in [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
304To give a workspace or channel broader access, create an organization-shared environment with a more permissive level and set it on that place's page, under **Advanced > Sessions > Environment**, as described in [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
305305
306306### Allow all hosts
307307
from line 319
319319
320320Opening a page is not part of the search. A search returns content from the pages it matches, which Claude reads and cites; fetching a URL from the sandbox is a network request, and the host needs an allow layer. Claude can answer from a page that search surfaced yet report that it can't open the same link.
321321
322If the work needs Claude to open and read pages rather than answer from search results, allow those hosts through the settings above. [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity#web-search-vs-network-requests) covers the session mechanics behind the split.
322If the work needs Claude to open and read pages rather than answer from search results, allow those hosts through the settings above. [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests) covers the session mechanics behind the split.
323323
324324## Attach plugins
325325
from line 333
333333* **Wherever a bundle applies**: on the bundle's page, under **What's in it**, click **Add** and choose **Plugin**.
334334* **One workspace or channel**: on that place's page, under **Claude's access**, click **Add** and select **Plugin** or **Skill**, then pick the plugin or skill in the dialog and click **Add**. The dialog lists only the plugins and skills already on the **Skills and plugins** tab. For one that isn't on the tab yet, add it there and then limit it under **Assign access** on its page, or add a plugin to a bundle that applies to the place.
335335* **Along with a connector**: when a connect form shows a checkbox to include the service's plugin, leave it selected to add that plugin with the credential.
336* **By a channel member**: a member can ask Claude to add a plugin available to your organization, in the channel or from the channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel), unless **Channel member edits** is set to **Block**; see [Restrict who can set channel instructions](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions). Claude proposes the change and adds the plugin only after someone in that channel selects **Confirm**.
336* **By a channel member**: a member can ask Claude to add a plugin available to your organization, in the channel or from the channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), unless **Channel member edits** is set to **Block**; see [Restrict who can set channel instructions](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). Claude proposes the change and adds the plugin only after someone in that channel selects **Confirm**.
337337
338Anthropic provides plugins for common tools and processes, and you can add your own from a [skills repository](/docs/claude-tag/admins/skills-repo). To give Claude organization-wide skills, package them as a plugin. Adding a plugin to your organization's library on claude.ai makes it available to Claude, not active; it takes effect only where you add it in one of the ways above.
338Anthropic provides plugins for common tools and processes, and you can add your own from a [skills repository](/docs/claude-tag/admins/skills-repo.md). To give Claude organization-wide skills, package them as a plugin. Adding a plugin to your organization's library on claude.ai makes it available to Claude, not active; it takes effect only where you add it in one of the ways above.
339339
340Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
340Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. See [What survives between replies](/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
341341
342342Claude can't publish a new skill version from inside a thread; that update happens in admin settings.
343343
from line 357
357357
358358## Related resources
359359
360* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit): fund usage so the connectors you just added can run
361* [Configure GitHub access](/docs/claude-tag/admins/configure-github): repository access, managed through the Claude GitHub App
362* [How agent identity works](/docs/claude-tag/concepts/agent-identity#agent-proxy): how the credentials you just added reach Claude without entering its sandbox
360* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md): fund usage so the connectors you just added can run
361* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): repository access, managed through the Claude GitHub App
362* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy): how the credentials you just added reach Claude without entering its sandbox
363363
No line in this hunk matches that.