Configure cloud environments changedcloud-environments
Nearest release: v2.1.312, published 21 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 28 Oct 2026 16:33 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Oct 2026 16:37 UTC.
Upstream edited
Recorded here
Lines+6added
Lines−7removed
From line
95
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits63to this page, all time
#### Add a secret without an organization admin role #### Add a secret on a Team plan without an organization admin role
The whole hunk
from line 95, old and new numbered
/
from line 95
9595
9696These requirements decide whether you can add a secret and whether the agent proxy can use it once added:
9797
98* **Role**: on Pro, Max, and Team plans, you can add and delete secrets on your own environments whatever your role. On Team and Enterprise, Owners hold an organization admin role in your claude.ai organization and Admins don't, which changes what you see in these cases:
99 * **Your own environment on Enterprise**: with an organization admin role, you add and delete secrets. Without it, the **Network secrets** row opens the secrets list with the note "Only an organization admin can add or delete network secrets" and no **Add secret** or delete button. Ask an Owner to add the secret to a [shared environment](#organization-shared-environments), then run your sessions there
98* **Role**: on every plan, you can add and delete secrets on your own environments whatever your role. On Team and Enterprise, Owners hold an organization admin role in your claude.ai organization and Admins don't, which changes what you see in these cases:
99 * **Your own environment**: without an organization admin role, **Add secret** opens a [shorter form](#add-a-secret-without-the-role)
100100 * **A shared environment**: Owners [add and delete its secrets](#add-a-credential) from admin settings. Without an organization admin role, ask an Owner to add the secret, because the environment's dialog has no **Network secrets** section
101 * **Your own environment on Team**: without an organization admin role, **Add secret** opens a [shorter form](#add-a-secret-without-the-role) that takes one host
102101* **Environment type**: an Anthropic-hosted cloud environment that already exists. A [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) doesn't have network secrets
103102* **API reachability**: the API accepts connections from the internet, because requests leave from Anthropic's network
104103* **Encryption keys**: if your organization uses customer-managed encryption keys, you can't save network secrets
from line 106
107106
108107You add secrets one at a time. To change a secret's hosts or value, delete it and add it again.
109108
110To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue from step 2 in its **Network secrets** section. If you're on a Team plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
109To add a secret to a [shared environment](#organization-shared-environments), open it for editing from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then continue from step 2 in its **Network secrets** section. If you're on a Team or Enterprise plan and don't hold an [organization admin role](#requirements), follow step 1 on your own environment, then [fill in the shorter form](#add-a-secret-without-the-role).
111110
112111**1. Open the environment's network secrets**
113112
from line 128
129128
130129To confirm the secret works, start a session in the environment and ask Claude to call the API, for example with `curl`. The API answers as if the key were in the request, and the key doesn't appear in the session's environment variables or in any file. If the list marks a secret **Not sent** instead, the note under it says why and what to do. Two secrets whose hosts overlap without matching exactly get no marker, and the agent proxy sends only one of them.
131130
132#### Add a secret on a Team plan without an organization admin role
131#### Add a secret without an organization admin role
133132
134If you're on a Team plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select your environment's [**Network secrets** row](#add-a-credential) and then **Add secret**. Fill in these fields and select the form's **Add secret** button:
133If you're on a Team or Enterprise plan and don't hold an [organization admin role](#requirements), the **Add secret** form takes one secret for one host. Select your environment's [**Network secrets** row](#add-a-credential) and then **Add secret**. Fill in these fields and select the form's **Add secret** button:
135134
136135* **Host**: the one host that gets the secret, such as `api.example.com`. The form doesn't accept a `*.` wildcard
137136* **Name**: an optional label for the secret
No line in this hunk matches that.