Identity token reference changedclaude-tag/admins/federated-access/token-reference
Nearest release: v2.1.290, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 18:54 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+7added
Lines−7removed
From line
8
where the diff opens
First seen
10 Sep 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99When Claude calls a system you connected through Federated agent access, it proves who it is with a signed identity token instead of a stored credential. The token is a JSON Web Token (JWT) that names your organization and the agent making the request. A gateway you run receives it in the `Authorization: Bearer` header and verifies it directly. AWS, Google Cloud, or your authorization server receives it in a token exchange and returns one of its own credentials.
1010
11This page lists what the token contains so the engineer who configures the verifying side can pin the right values. For setup steps, see [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway), [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws), [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp), or [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server).
11This page lists what the token contains so the engineer who configures the verifying side can pin the right values. For setup steps, see [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md), [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md), [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md), or [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md).
1212
1313## Issuer and signing keys
1414
from line 51
5151* The organization ID starts with `org_` and the agent ID with `cagt_`. Both use only letters, digits, `_`, and `-`, so neither can contain `/` or `:`.
5252* The **Connect a gateway**, **Connect an AWS role**, **Connect a Google Cloud identity**, and **Connect an authorization server** dialogs show your organization's **Subject prefix**, `wimse://identity.anthropic.com/org/<your organization ID>/agent/`. Every one of your agents' subjects starts with this prefix.
5353* An agent belongs to one Slack channel. Deleting and recreating a channel creates a new agent with a new ID. The console doesn't show agent IDs; a verifier learns full subjects from the tokens it receives or from your cloud provider's logs.
54* The console's connection check for a gateway presents a token for a reserved test agent in your organization, shown in the **Connect a gateway** dialog as the **Control subject**. Your gateway must answer that token with a 2xx status so the check can pass, and must grant that subject no access. See [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway).
54* The console's connection check for a gateway presents a token for a reserved test agent in your organization, shown in the **Connect a gateway** dialog as the **Control subject**. Your gateway must answer that token with a 2xx status so the check can pass, and must grant that subject no access. See [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md).
5555
5656The `wimse://` form follows the IETF WIMSE working group's workload identifier specification.
5757
from line 149
149149
150150## Related resources
151151
152* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway): verify the token yourself at a service you run
153* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws): the trust policy that pins these values
154* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp): the attribute condition that pins these values
155* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server): accept the token as a JWT bearer grant
156* [Limits](/docs/claude-tag/admins/federated-access/limits): lengths, counts, and lifetimes in one place
152* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md): verify the token yourself at a service you run
153* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md): the trust policy that pins these values
154* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md): the attribute condition that pins these values
155* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md): accept the token as a JWT bearer grant
156* [Limits](/docs/claude-tag/admins/federated-access/limits.md): lengths, counts, and lifetimes in one place
157157* [Sample gateway](https://github.com/anthropics/claude-tag-wif-gateway-sample): a Python gateway that verifies the token and pins subjects exactly or by organization, with offline tests
158158
No line in this hunk matches that.