Deploy Claude Desktop on 3P with Google Cloud's Agent Platform changedthird-party/claude-desktop/vertex
Nearest release: v2.1.314, published 6 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 29 Oct 2026 17:39 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 29 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+11added
Lines−11removed
From line
285
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 285, old and new numbered
/
from line 285
285285
286286Since 1.2581.0
287287
288**Vertex AI base URL.** PSC endpoint, if using one.
288**Vertex AI base URL.** Private Service Connect endpoint, if you use one.
289289
290290***
291291
from line 305
305305
306306stringSince 1.2581.0
307307
308**Vertex OAuth client secret.** Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config.
308**Vertex OAuth client secret.** Secret for the Desktop-app OAuth client above. Google does not treat such secrets as confidential, so the Admin Console can set it.
309309
310310***
311311
from line 359
359359
360360> **More detail**
361361>
362> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration; the same rules apply here.
363> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the workforce-pool IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceVertexWorkforceOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux.
362> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
363> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
364364>
365> The GCP STS token-exchange step is unchanged in either flow; only how the Entra id\_token is acquired differs.
365> `broker` needs Microsoft Entra ID, with the `issuer` in `inferenceVertexWorkforceOidc` set to `https://login.microsoftonline.com/{tenant-id}/v2.0`. Add the redirect URIs listed under [Register the Entra ID application](https://claude.com/docs/third-party/claude-desktop/entra-broker.md#register-the-entra-id-application).
366366
367367***
368368
from line 374
374374
375375Since 1.10628.0
376376
377**Workforce Identity IdP (OIDC).** Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS.
377**Workforce Identity IdP (OIDC).** Your organization’s OpenID Connect identity provider. Users sign in there, and the app exchanges their ID token at GCP STS.
378378
379379> **Child attributes (9)**
380380>
from line 410
410410>
411411> **omitOfflineAccess** `boolean`
412412>
413> Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires.
413> Turn on only if your identity provider rejects offline\_access on this client. Users then sign in again each time the token expires.
414414>
415415> **additionalRedirectReferrerHosts** `string`
416416>
417> Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.
417> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
418418>
419419> > **More detail**
420420> >
421> > Only needed when the IdP completes sign-in from a host other than the authorization URL’s. When a callback is rejected for a referrer mismatch, the rejected host is named in the app log — add that hostname here.
421> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
422422
423423***
424424
from line 430
430430
431431Since 1.2581.0
432432
433**GCP credentials file path.** Absolute path to service-account JSON. Leave blank to fall back to ADC.
433**GCP credentials file path.** Full path to a service-account JSON file. Unset: Application Default Credentials.
434434
435435***
436436
No line in this hunk matches that.