Deploy Claude Desktop on 3P with Google Cloud's Agent Platform changedthird-party/claude-desktop/vertex
Nearest release: v2.1.309, published under an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 22 Oct 2026 20:16 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+174added
Lines−29removed
From line
253
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits13to this page, all time
#### `inferenceVertexProjectId` #### `inferenceVertexRegion` #### `inferenceVertexBaseUrl` #### `inferenceVertexOAuthClientId` #### `inferenceVertexOAuthClientSecret` #### `inferenceVertexOAuthScopes` #### `inferenceVertexOAuthLoginHint` #### `inferenceVertexWorkforceAudience` #### `inferenceVertexWorkforceUserProject` #### `inferenceVertexWorkforceAuthFlow` #### `inferenceVertexWorkforceOidc` #### `inferenceVertexCredentialsFile`
The whole hunk
from line 253, old and new numbered
/
from line 253
253253
254254The region can be a single region such as `us-east5`, the `eu` or `us` multi-region, or `global`. The app routes inference to a different endpoint host for multi-regions and `global`; if you allowlist egress by hostname, see the [inference provider egress hosts](/docs/third-party/claude-desktop/telemetry.md#inference-provider).
255255
256| Setting | Type | Availability | Default | Description |
257| - | - | - | - | - |
258| GCP project ID `inferenceVertexProjectId` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Google Cloud project ID for Vertex AI inference. |
259| GCP region `inferenceVertexRegion` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | GCP region where your Vertex AI Claude models are deployed. |
260| Vertex AI base URL `inferenceVertexBaseUrl` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | PSC endpoint, if using one. |
261| Vertex OAuth client ID `inferenceVertexOAuthClientId` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file. |
262| Vertex OAuth client secret `inferenceVertexOAuthClientSecret` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config. |
263| Vertex OAuth scopes `inferenceVertexOAuthScopes` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Override the Google OAuth scopes (space-separated). Leave blank for the default. |
264| Vertex OAuth login hint `inferenceVertexOAuthLoginHint` | `string` | MDM + Bootstrap Added in 1.12603.0 | — | Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name. |
265| Workforce Identity audience `inferenceVertexWorkforceAudience` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity. |
266| Workforce Identity billing project `inferenceVertexWorkforceUserProject` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | GCP project for STS billing and quota. Defaults to the Vertex project ID above. |
267| Workforce Identity sign-in flow `inferenceVertexWorkforceAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. |
268| Workforce Identity IdP (OIDC) `inferenceVertexWorkforceOidc` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS. |
269| GCP credentials file path `inferenceVertexCredentialsFile` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Absolute path to service-account JSON. Leave blank to fall back to ADC. |
256[Entry labels](/docs/third-party/claude-desktop/configuration.md#entry-labels) says what each label means.
270257
271> **inferenceVertexWorkforceAuthFlow details**
258#### `inferenceVertexProjectId`
259
260string
261
262Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
263
264Since 1.2581.0
265
266**GCP project ID.** Google Cloud project ID for Vertex AI inference.
267
268***
269
270#### `inferenceVertexRegion`
271
272stringSince 1.2581.0
273
274**GCP region.** GCP region where your Vertex AI Claude models are deployed.
275
276***
277
278#### `inferenceVertexBaseUrl`
279
280string
281
282Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
283
284Origin-pinned (A URL that a bootstrap server delivers must share the origin of bootstrapUrl, or Claude Desktop drops it. The limit is lifted when bootstrapOidc is set, and it does not apply to a value set in an MDM profile, the local configuration file or the Enterprise Admin Console.)
285
286Since 1.2581.0
287
288**Vertex AI base URL.** PSC endpoint, if using one.
289
290***
291
292#### `inferenceVertexOAuthClientId`
293
294string
295
296Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
297
298Since 1.2581.0
299
300**Vertex OAuth client ID.** Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file.
301
302***
303
304#### `inferenceVertexOAuthClientSecret`
305
306stringSince 1.2581.0
307
308**Vertex OAuth client secret.** Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config.
309
310***
311
312#### `inferenceVertexOAuthScopes`
313
314stringSince 1.2581.0
315
316**Vertex OAuth scopes.** Override the Google OAuth scopes (space-separated). Leave blank for the default.
317
318***
319
320#### `inferenceVertexOAuthLoginHint`
321
322stringSince 1.12603.0
323
324**Vertex OAuth login hint.** Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name.
325
326***
327
328#### `inferenceVertexWorkforceAudience`
329
330string
331
332Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
333
334Since 1.10628.0
335
336**Workforce Identity audience.** Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity.
337
338***
339
340#### `inferenceVertexWorkforceUserProject`
341
342string
343
344Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
345
346Since 1.10628.0
347
348**Workforce Identity billing project.** GCP project for STS billing and quota. Defaults to the Vertex project ID above.
349
350***
351
352#### `inferenceVertexWorkforceAuthFlow`
353
354enumSince 1.25927.0
355
356**Workforce Identity sign-in flow.** How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.
357
358One of: `browser`, `broker`
359
360> **More detail**
272361>
273362> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration; the same rules apply here.
274363> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the workforce-pool IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceVertexWorkforceOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
from line 364
275364>
276365> The GCP STS token-exchange step is unchanged in either flow; only how the Entra id\_token is acquired differs.
277366
278> **inferenceVertexWorkforceOidc details**
367***
368
369#### `inferenceVertexWorkforceOidc`
370
371object
372
373Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
374
375Since 1.10628.0
376
377**Workforce Identity IdP (OIDC).** Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS.
378
379> **Child attributes (9)**
279380>
280> | Field | Type | Default | Description |
281> | - | - | - | - |
282> | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). |
283> | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. |
284> | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. |
285> | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. |
286> | `scopes` | `string` | — | Space-separated scopes. Defaults to openid profile email offline\_access. |
287> | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. |
288> | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. |
289> | `omitOfflineAccess` | `boolean` | — | Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires. |
290> | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. |
381> **clientId** `string` *required*
382>
383> OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).
384>
385> **issuer** `string`
386>
387> HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.
388>
389> **authorizationUrl** `string`
390>
391> HTTPS authorization endpoint. Used with the token URL when no issuer is set.
392>
393> **tokenUrl** `string`
394>
395> HTTPS token endpoint. Used with the authorization URL when no issuer is set.
396>
397> **scopes** `string`
398>
399> Space-separated scopes. Defaults to openid profile email offline\_access.
400>
401> **redirectPort** `integer`
402>
403> Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.
404>
405> **redirectHost** `enum`
406>
407> Use localhost only if your IdP’s registered redirect URI specifies it.
408>
409> One of: `127.0.0.1`, `localhost`
410>
411> **omitOfflineAccess** `boolean`
412>
413> Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires.
414>
415> **additionalRedirectReferrerHosts** `string`
416>
417> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
418>
419> > **More detail**
420> >
421> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
422
423***
424
425#### `inferenceVertexCredentialsFile`
426
427string
428
429Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
430
431Since 1.2581.0
432
433**GCP credentials file path.** Absolute path to service-account JSON. Leave blank to fall back to ADC.
434
435***
291436
292437If none of `inferenceVertexCredentialsFile`, the OAuth client keys, the Workforce Identity keys, or `inferenceCredentialHelper` is set, the Google client library falls back to the standard Application Default Credentials search path on the device (`~/.config/gcloud/application_default_credentials.json`, then the environment's metadata server).
293438
No line in this hunk matches that.