Deploy with a bootstrap server changedthird-party/claude-desktop/bootstrap
Nearest release: v2.1.314, published 6 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 29 Oct 2026 17:39 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 29 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+16added
Lines−10removed
From line
383
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits33to this page, all time
The whole hunk
from line 383, old and new numbered
/
from line 383
383383
384384Since 1.10628.0
385385
386**Use bootstrap config.** Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch.
386**Use bootstrap config.** Fetch and apply settings from the bootstrap config URL at launch. Turn off to keep the URL saved but skip the fetch.
387387
388388***
389389
from line 407
407407
408408Since 1.10628.0
409409
410**Bootstrap OIDC parameters.** When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE).
410**Bootstrap OIDC parameters.** Your organization’s OpenID Connect identity provider. The user’s token from a browser sign-in is sent as Bearer to the bootstrap server.
411411
412412> **More detail**
413413>
414> Set this to use a separate identity provider (Microsoft Entra ID, Okta, Ping, or any compliant OIDC provider) for the bootstrap sign-in. The app runs an authorization-code-with-PKCE flow in the system browser. Omit to use device-code mode against the bootstrap server's own origin.
414> When unset, the bootstrap sign-in uses a device code on the bootstrap server's own origin.
415415>
416> This is an **object-typed key** — in an MDM profile it is a single JSON-string value, not separate keys with dotted names like `bootstrapOidc.clientId`. Writing the sub-fields as separate registry values causes the app to silently fall through to device-code mode.
416> In an MDM profile, write this key as one JSON string. Separate values such as `bootstrapOidc.clientId` do not work: the app silently uses the device-code sign-in instead.
417417
418418> **Child attributes (8)**
419419>
from line 449
449449>
450450> **additionalRedirectReferrerHosts** `string`
451451>
452> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
452> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
453453>
454454> > **More detail**
455455> >
456> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
456> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
457457
458458***
459459
from line 469
469469
470470> **More detail**
471471>
472> Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead.
472> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch.
473>
474> These headers, and those of `bootstrapHeadersHelper`, also go to a plugin marketplace on this server's own origin, if its `allowedPluginMarketplaces` entry sets `credentialKind: "inferenceCredential"`.
475>
476> Header values are masked in diagnostics and telemetry.
473477
474478***
475479
from line 489
485489
486490> **More detail**
487491>
488> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`.
492> Example output: `{"Authorization": "Bearer …"}`. The app runs the helper script with no arguments and reuses its output for a few minutes.
493>
494> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs, its token takes priority for the `Authorization` header.
489495
490496***
491497
from line 503
497503
498504Since 1.26832.0
499505
500**Trust bootstrap-delivered settings.** Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers.
506**Trust bootstrap-delivered settings.** Skip the per-user consent prompt for sign-in settings, inference endpoints, helper scripts, and connectors the bootstrap server delivers.
501507
502508***
503509
No line in this hunk matches that.